258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
Size

142KB
MD5

6b36d36b1b38a8e08598fc496e2a6211
SHA1

b4602285be2e116b0ca5633494163482248be1d2
SHA256

258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b
SHA512

187a61f02bca1e0b1b38eebd578a3d42432686eaa17a678c7f50c9f38d4660f52203d6f60ccd037fa08576c624194b25b5119f73df4ef9f6297bb6bd510a8858
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCm:+nymCAIuZAIuYSMjoqtMHfhflixi7hZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3432) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000d000000012324-2.dat	UPX
behavioral1/files/0x0002000000010674-6.dat	UPX
behavioral1/memory/2208-652-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000012324-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2208-652-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe

C:\Users\Admin\AppData\Local\Temp\258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe
"C:\Users\Admin\AppData\Local\Temp\258284dd5c60b8cbe624f86e17846d749a091fe945c8295b9b2d446f1ca0e72b.exe"
1⤵
- Drops file in Program Files directory
PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
142KB

MD5
0c708f68cf87da53a794ef19c9873246

SHA1
8f303a0c76c6362ac3e4b07bb1acb0c5404344dc

SHA256
e4c437f9754beb1434d414eb1c7f23dcf42b555513a54d2dd7f020ea8acf74bc

SHA512
b7787df8995c7113a49214ba451f0f57489a68f747070cdf37674033b3be24c9cf9a768df120193ed82550954cf796213268d0ea0ee5cb9d73f0b73eb5f1b172

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
151KB

MD5
c03ccac2300a652e560c46b3b185c4ab

SHA1
5c8d5b67dc76f1d784841546e9d86b9335e5179d

SHA256
c861f8cb88be45713b53c4c49f107853061e13da50004de6bcaf454c22716ef4

SHA512
3f8cfac091961a671cdd342bccf963275bf4f021fa40261d36ae7509f9eae104fba33d8ba767b0ff8b992275a9101734fe757af041ede06f81126a366116eeb9

Download Submit
memory/2208-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2208-652-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download