9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
Size

61KB
MD5

6e6dc34e7f5c5b888538e0c2a0975733
SHA1

2e617c436517a26b4dc2c3b8643dc3918d355b76
SHA256

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51
SHA512

02f4144e3278c8287de980c243fba0fff04b003c3b9c662b53830f470829a9a99737cd78710ad909c5b544aeb87c9f7c851ea52242e62d12f6d6cd05e84890e4
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sw:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/QE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3761) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000c0000000136fc-2.dat	UPX
behavioral1/files/0x00020000000106dd-6.dat	UPX
behavioral1/memory/1724-648-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c0000000136fc-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/1724-648-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\release.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe

C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
"C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe"
1⤵
- Drops file in Program Files directory
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
61KB

MD5
9053fe94b554ed9f07fb4a835ea16723

SHA1
22cfc44d2a07189c6727aab0eda59360547958e8

SHA256
ade8e69c05c51e36f14463f685035df7331d1cbd96be9e5558594e5f883bc7da

SHA512
b742dd2591ad2bc8b1f5dcf580f477c2c6fed8215332fa0b5104e234fa249c7463e78ff04702067f86a06a1d2d23d2eda477316cb1c41d1b1f76fe5bf2585fe2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
236f1535c2076548eb77825160d7dac3

SHA1
910b1b2489620104b240483a065b427212c95146

SHA256
7d587dfaa1a5e2916d2e1f7cdb343731b1b7c14b84a69454267a7e89963817fa

SHA512
8d446212694f567a07bec635758d3094e6d7978a8ff9552a065cf9e6aa88b8a511eeba13f86e3342707b8619036b848a3f098a652c4ced154e844c9b25534620

Download Submit
memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1724-648-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download