06613449594e50c32490c868ee49b73a93d417f667839302ffab330ba2f18e50

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04a044f515d960e9ebbd77546ea5fc6a.exe
Size

164KB
MD5

04a044f515d960e9ebbd77546ea5fc6a
SHA1

fa38bd82c39fd6d9c30fa624bb9310a627561f00
SHA256

06613449594e50c32490c868ee49b73a93d417f667839302ffab330ba2f18e50
SHA512

de3674b16de52994992eefb284b9d10162b73a0e3d21d0ad063a33ae70d22aba7cb0571d6d3fefc73dac3e8a276cf16e5ae817d54743712f41e9124e53bd6020
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJBg:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuw

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (381) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a00000001466c-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/2072-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\FindRepair.odt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	04a044f515d960e9ebbd77546ea5fc6a.exe

C:\Users\Admin\AppData\Local\Temp\04a044f515d960e9ebbd77546ea5fc6a.exe
"C:\Users\Admin\AppData\Local\Temp\04a044f515d960e9ebbd77546ea5fc6a.exe"
1⤵
- Drops file in Program Files directory
PID:2072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
164KB

MD5
37696cda3b98e668703865709678cf26

SHA1
4e436b7bb2dbe25da9f148eecbb7704dc0e70ad7

SHA256
3284af0651aef41b023ec51706d5ccf8796f459595fd727a0dba72ac571856cf

SHA512
bbcf70cdbb74047ec133c8fa8e836fbc29f913f01fbf5d18ddcc8afc8adb6d3e9a39dba35324da39a8fbd67f2b9ecb2ef196af040a4c3ddaf5683f4e1dac7395

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
173KB

MD5
ac3b6e0424df0beb390693a8e69fbac8

SHA1
7686db63e5bc71e8695bf39cfb268b73a0b4aaf1

SHA256
e62c9549f78eca64064287a04fc8b28fa31e1cff1abd47b66b209e5e8983a6cf

SHA512
3731c693874e7a9759838cc1a0a876afa4f99dee0d6f579d508d9570f8ecd49e6c5e70bf1771a332f161e84ed35879f7cad50a434ab45581c140bec0d1244e9f

Download Submit
memory/2072-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2072-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads