6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
Size

109KB
MD5

f1d7aba18991d33b132ad05529bc691d
SHA1

1e189d90fa324fe70890b79891f587d49accf9fc
SHA256

6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587
SHA512

17832473939a3076ee0d10750c251c12d7bf3840581c39e68a0a65592169d2b9476498f4a0f75c33beda7af7c36d53ce1be9638e4a7f7b70bcdd8d9ccbac1f0e
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfO:hfAIuZAIuYSMjoqtMHfhfO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3474) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1432-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000b000000012301-2.dat	UPX
behavioral1/files/0x000200000001048e-6.dat	UPX
behavioral1/memory/1432-80-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1432-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012301-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/1432-80-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\weather.css.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\BackupClose.vdw.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp	6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe

C:\Users\Admin\AppData\Local\Temp\6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe
"C:\Users\Admin\AppData\Local\Temp\6d607115a7bdbd102abe25f33e6d603d92da9a92a9310cdd71b5ec873322d587.exe"
1⤵
- Drops file in Program Files directory
PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
110KB

MD5
18fa800396603642fc1d0a0166ab4c0c

SHA1
9fce3053a2755ee5ed9f95e3de59ca560f3310c5

SHA256
f4a33655f033b2998f477873cee76fc288c6a7587abb3b3cc852d91694c5bab4

SHA512
264ccfb539fa42de12da31fea1c7cd49d7918cadb9acc5216676ea9eb2f061038091c649a0f1644b634c69ec71d1bd5c7771ec0d2fea02bf029544b2b9caba88

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
119KB

MD5
1f2293546803e88f29b1663ba012834a

SHA1
231743df8bbbccb01e80e8bcab5117b9c8e106a8

SHA256
142c3f1cb3dcc3dee8d1c8c6728d97ef4cd3f80717b9e922ec76b013ad4e1607

SHA512
faae159d60ef845906e70146c5eaff356bbd9b86a45940c69de872683e4a291a054203030947327a834e9cf306e05f1181a0e6c807f822e16a9fa459b09871c9

Download Submit
memory/1432-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1432-80-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download