185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
Size

107KB
MD5

4716b896173bee922c797693ffeadd91
SHA1

f7000396d620623bb43386c09bc83961879ae624
SHA256

185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110
SHA512

ab925043ed943579c96b95ce025ec140cf810395ce40fb6528b88255216bd205be87a49999fb861c8ab4750dc7628add6c7036730b4515e7ad49133ea90190fe
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfS/B:hfAIuZAIuYSMjoqtMHfhfqnB

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000b000000014ef8-2.dat	UPX
behavioral1/files/0x001c000000010439-6.dat	UPX
behavioral1/memory/1988-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000014ef8-2.dat	upx
behavioral1/files/0x001c000000010439-6.dat	upx
behavioral1/memory/1988-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\ResolvePush.ex_.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
File created	C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui.tmp	185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe

C:\Users\Admin\AppData\Local\Temp\185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe
"C:\Users\Admin\AppData\Local\Temp\185734612dafd25162c0b3ebba015c9b20699b8bfc9c8cbbb959bd51ca56b110.exe"
1⤵
- Drops file in Program Files directory
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
108KB

MD5
5c86167c3fdab3a7d46add82ff9e4c70

SHA1
22872542dd016b371e2607cfe917faf75d5dac4f

SHA256
54cd4b250f5798de4e0ced1c20187d8f73813e63303e83ebaf67ccb0a75e504f

SHA512
73144e6a35eadd6ecbdc95a90289ae19a5f802816a024d220423a99a7004f0639e034edbeb6ea2426a8db61a9fe3d4928c1f1412d355f596ab170f5fc3aec950

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
117KB

MD5
b62aad165f562ecb836abe0d20681be3

SHA1
4d77a6c1377ffc2bac4e31c41f6816d2eb6af8d8

SHA256
7b4f2102278140e416c6bd5fa8b75ad9bd923155339c75ce47e4ceb90c2ee9be

SHA512
cb41e689c9b0d90808e27f0dce8535ee0527ba388b37e1de4b55f3b16d919d95eb1cc3dee75061cf941b696795455a5f911cdb24f3c98b4f69a72f9145d01b88

Download Submit
memory/1988-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1988-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download