192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
Size

53KB
MD5

658d3d0691c138533051d139ba21747d
SHA1

6b6bf31f2203ca3723d51f37355da46163ec816c
SHA256

192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6
SHA512

b08b22ffbaf8842c6061c2607f6498e3a1a698060dc26b9fe591cb4bf08430fd70bb9abfd9fa03451ec7f0fbecfffdc844b34c5b78fc0071168f8c31e44547e4
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFZj:67Zf/FAxTWY1++PJHJXA/OsIZL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (775) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1808-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b000000015a2d-2.dat	UPX
behavioral1/files/0x002b000000015c2f-6.dat	UPX
behavioral1/memory/1808-68-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1808-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000015a2d-2.dat	upx
behavioral1/files/0x002b000000015c2f-6.dat	upx
behavioral1/memory/1808-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DismountOpen.dotx.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe

C:\Users\Admin\AppData\Local\Temp\192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe
"C:\Users\Admin\AppData\Local\Temp\192c0ae6bce5cc382ed5bf22a92852c3dbb24e9a502c26bbafc9022ff06cb1c6.exe"
1⤵
- Drops file in Program Files directory
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
53KB

MD5
5312fb3b0795ea8b4493e9ca97d0ac3d

SHA1
d7b62747a58295b747e31f91d500719553b516cf

SHA256
e634bcc9a2ac4f79841401aaedd12a8c2af6205e781a91a9d4d18e69bd36e282

SHA512
b2f21d9dcdc1b42fe08c517e0c3ff09843b3e6a859c1cd2b72227d0ab17f893e40c09d2882dbe83cae4ea27e0e6041d6327fb6b3a62ceb9cc9de8adc33f654bd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
afd3beaf23f30e791a3b2e3ed6e53c75

SHA1
968b13684c557f29854541df8feaddde40669f2c

SHA256
dabdba1a0172d74568cab19b5c91fd30f75560a33d4045faebdf0083e415838c

SHA512
c4ac1b861f1ec3739b3704bd196b3ab07d2876871511a1da5fb90a577972a04200d6ff7e1dec3fd66694e4bf603882e3960f5149946feb40840e9c81998d42c7

Download Submit
memory/1808-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1808-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download