4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
Size

168KB
MD5

8b8f7619d9c06f6167a8c6ba7dee0580
SHA1

61d45145859b4ded93169e88544fc2d2dd649ba1
SHA256

4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0
SHA512

e9bffd6d740d777cec6bd9f498137587fa7a0187c18c30039da07daeae29ef92a1ab1e0a09c42a5e1a6a62843c663c008494b3ba5f9520099e2e53612a1df52a
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuE:JiQSo1EZGtKgZGtK/CAIuZAIuE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3385) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b00000001226d-2.dat	UPX
behavioral1/files/0x00020000000104db-6.dat	UPX
behavioral1/memory/2008-536-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b00000001226d-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/2008-536-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ps_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_dummy_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp	4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe

C:\Users\Admin\AppData\Local\Temp\4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe
"C:\Users\Admin\AppData\Local\Temp\4d69cb07645bae0a8810ff2806f9a2af14ba1d0d5ea451da9684101eeb2f11c0.exe"
1⤵
- Drops file in Program Files directory
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
168KB

MD5
a8789aac031445e2c721ae4f04f05fe6

SHA1
e1a2b4b256289d864184fb79329c27ce60452a3a

SHA256
f3e5c71ef52b9ca7fc481349c372cf422648274535dd75f2b6ba021e2fa7efd4

SHA512
93c3fa189368ad30163bf1f425f029d1f4a1fc625f20d587d98fe4486e8892ccb86987b783e5bc8c7f3d9b36d1f11b4d3fa4f3b3e303244cc005b72b0e7b2e56

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
177KB

MD5
2cffbb84d059d0b41fea7a6934430723

SHA1
4ecd9ade9056c68155ff772e391cfe5df70ca23a

SHA256
5f5f609d48b74463de171b6dc84c7e86cb61820efc96d28d698213a792db15ec

SHA512
77d607b58b41819b1c0f8f34b06a2663da910d596b56eebde816628948d10341b903eb0caeebd988d4b35bc6af0b215558e90874b66e89998f44638c48e32a72

Download Submit
memory/2008-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2008-536-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download