099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
Size

45KB
MD5

f98a261cfca6f109066daa5626a39a0e
SHA1

337a63bd15ecf686a8f20d38ec741c5c12f1def0
SHA256

099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1
SHA512

9fff428a38708224c4e92a8cb9abe21f449353cfabeecf0294dc69d35c75b92dbae9b9bc08c4a7206a1c990e40e2272cb37eeb35eebfd2647b531c5e89235492
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIO:CTWn1++PJHJXA/OsIZfzc3/Q8PxF

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3755) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000f00000001214d-2.dat	UPX
behavioral1/files/0x00020000000104db-6.dat	UPX
behavioral1/memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000f00000001214d-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\EEINTL.DLL.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmplayer.exe.mui.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe

C:\Users\Admin\AppData\Local\Temp\099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe
"C:\Users\Admin\AppData\Local\Temp\099262b36c3beb9e49eafefdf4eb537969ff759546782e52c9dcddcd7b94ace1.exe"
1⤵
- Drops file in Program Files directory
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
45KB

MD5
f0cc8ff137cb9aad870ef9fa0596e118

SHA1
347b55716193225b45a3e76d5ff872bf00cd1c55

SHA256
ff08981096937d18c29dd8053cd15f55db97c8c2d7ae340ce0fa9ff6108d2a4f

SHA512
b3f097b85e3a27d2a73387180dfbc8a62bf548f7ac7e12f3b99db1c5f2de53d4754bf0578e86472cc5493bef547acefae4f16b17738e9e2b63f18bcc17cffa5d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
5ac72e822103b017bbda30cd7754e613

SHA1
393ed545904624288dc08821c97f1271a95baba0

SHA256
cfd93e66bcd4add3df19b256dc8637ebddba380ea617b0cbfbffac6e2b597cb0

SHA512
62dbb2d7d11a1ecec6ab93ef1db73f9248ea203a728eb019b2e02ead4aad79f1eff1c44dafa6d03d6e1e0d432ff30e0f4d4a92e7f1e81c2e1e3079ce1103c952

Download Submit
memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download