bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593

General

Target

bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
Size

627KB
MD5

a8a22d60459533546a3a39fcb748350d
SHA1

efc376bb5b42051e3576d87f6092c3c247a1a7f3
SHA256

bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593
SHA512

775e27afaa8d36020aa5690787c982f8a6a17488d877266861ae9aec4dcce1e22bd8fc0f3cc9f7258364114036ea43dae69709d5cfac1ee4e628e02e3ab017a9
SSDEEP

12288:7AIuZAIuOAbh9txT3kTa1YXEylrepuyhTAmiZX2r1/Oy/SIEa61jhFqQ:I8TYa1KutFAmiZX8/PqIEpjhMQ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (229) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2264-68-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2264-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\desktop.ini.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe

C:\Users\Admin\AppData\Local\Temp\bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe
"C:\Users\Admin\AppData\Local\Temp\bb41e7bfa198367df46be3afa7de9d5e199cc7da7144a8b0533a33c61bec8593.exe"
1⤵
- Drops file in Program Files directory
PID:2264

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
Filesize
627KB

MD5
e5bbff9154752730497e7eb4520a0367

SHA1
08bce2987506dfec9037d8b1cfc5df854a953756

SHA256
bbdd9f3f77aea69ef82939d1ce07239a2278415001c9f167b78c69a141212bb2

SHA512
7565fcb007fb52acb3f8b8c43c15078303cd0e80a9b928b4817098ef8e088b2d703cdac8272d4a1558cde5da4ac20a94ca880ce7514d8e931fb7d1e1b68ec31f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
636KB

MD5
1bfe1d83acc33d728524af3025311a0d

SHA1
f712b10f8170c6d8eed642ae9e47b786ba8335bf

SHA256
152b26e0b49ed87c74ef8ef87522c1c922491c60f2e6dcc82d92f220a9ccee21

SHA512
edfcd97ba5c746fba00526a3de89aa5fee2b59129fdbaee9a2d6871a568415d4e746d235f036344ca7e1a03a329111114fa0a9f557e1a25f75ec2cd3289d1787

Download Submit
memory/2264-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2264-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads