b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
Size

62KB
MD5

9c3e9896bac180ca851882cdcd2711e5
SHA1

9441b2e1b33dd9ef009a2ecaf0fc648cc92add96
SHA256

b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382
SHA512

d3e31a94cd3edd8fac3ed5b3bf3a4c73a6cb3609cd8932aa390e5370ba6e77adebf0c0ed7c000147f85ee44d892abeb2287b96294f4ed287440f65c00c413da2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8a:fnyiQSoR

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (532) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000c00000001445e-2.dat	UPX
behavioral1/files/0x0002000000010481-6.dat	UPX
behavioral1/memory/2244-68-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001445e-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/2244-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunmscapi.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe

C:\Users\Admin\AppData\Local\Temp\b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe
"C:\Users\Admin\AppData\Local\Temp\b8d2df275f003d5179e86c1d0740ba5793f977ed476371e8582a9cb13066b382.exe"
1⤵
- Drops file in Program Files directory
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
63KB

MD5
bf8e054c868e4ee5334540260a4ed683

SHA1
6e589238ef2b0b140e63f98b3eb28f4829463f97

SHA256
cbcf01f7485854c9b2e9155006aee1f90af625c5fd4ed3f92a104e1d3549c0a2

SHA512
9a0bcb30ecb0bde7dd2baa2604f049c8791c8554f4cecd2d24b5a9680b3374551ba59493610bb758b4b5863acba2b58591d495e0b1263d26d8644e85a8448a40

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
b078b69bf3da803e525d703e52943228

SHA1
27843e97a4067e401a42d918e14c6f7f5db5fcb9

SHA256
246140d19329d88f51139b3d1cbec6b962de8066babf071d05916b4a753f224d

SHA512
8fa830ddd70af09df4a38e73fce0f413e58a45f2f11d2149a6eaa16dfcc8cfc3426f4dc025560cbd16e89a0da5915b60cd951888343c3408f43df58ce6bc58a5

Download Submit
memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2244-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download