a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
Size

112KB
MD5

07d0d1e203a1cc0814727763c3affe6b
SHA1

492c356635f07d571963f2b00619354abf82fc8d
SHA256

a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584
SHA512

6b5276b82ad63703dc2188471a59fd4c96862c7be3ac9e291b9a4131bbe1b824f819ff3496ed0bd35ce957b3935225c43238614ff5102612943f521eb21e71b5
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0x1:hfAIuZAIuYSMjoqtMHfhfg

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000f00000001214d-2.dat	UPX
behavioral1/files/0x00020000000104db-6.dat	UPX
behavioral1/memory/2204-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000f00000001214d-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/2204-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_pressed.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Windows Journal\Templates\Genko_2.jtp.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe

C:\Users\Admin\AppData\Local\Temp\a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe
"C:\Users\Admin\AppData\Local\Temp\a9a45ecc8b7d594697f0538865a0cd1f284b9fb6de8c112b84bf1c79257a9584.exe"
1⤵
- Drops file in Program Files directory
PID:2204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
112KB

MD5
8af63d1f3f5d693bca9786dbdbf95752

SHA1
8ea36808121015fbc5d3e0585f3d8b8e00c201a5

SHA256
718be2bd4ac9d4bc78231b312e9c1e5183e1007f4c09cfd4ede392fb95431749

SHA512
e650ecb1889cbb3b3576ae1f09ff74f4411bda5c69ecfe1eea58f90e8411b5f7a646a97bfd8d477333a8154c8a22b99c3269bc37fa2acdc4db3cbff5c8b50671

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
121KB

MD5
adb15a3a1c567e46127fe6fbb9b8cb01

SHA1
171daf5822a255dffdebf48f85f7c7179cfcc0c4

SHA256
a0c4b06d992967f0f1d6032e587978e7213261dd384ee8f116c4135bebad9aa7

SHA512
db392d6655778d4742cfa486d943d2fc802c85ff8405ba32b1146eeba3ae77ce8b63581372d63f800453e293836b918ba14a342c0be4c4e6209fb30c6639884b

Download Submit
memory/2204-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2204-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download