61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
Size

127KB
MD5

dfb42a94d2134dda7ade56463d571c9e
SHA1

3ffb9e64b767dd693c2c1eb320915a66d5712adb
SHA256

61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f
SHA512

b0cbeb42b15b090b6850290f4e53dd50a24671c5e5d8f8d78c6b492dab84457dbeb6623ae56895815dfbd7937b497a961aadbd3d7c63a802448a37eba6f8a975
SSDEEP

1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCC:fnymCAIuZAIuYSMjoqtMHfhfr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3262) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2284-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000a000000012280-2.dat	UPX
behavioral1/files/0x00020000000106a2-6.dat	UPX
behavioral1/memory/2284-358-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2284-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012280-2.dat	upx
behavioral1/files/0x00020000000106a2-6.dat	upx
behavioral1/memory/2284-358-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Mozilla Firefox\mozavutil.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe

C:\Users\Admin\AppData\Local\Temp\61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe
"C:\Users\Admin\AppData\Local\Temp\61f462902cca52648d40e43ae227b5002ea99ef71ccc1bcf62bd57b5a56a8b3f.exe"
1⤵
- Drops file in Program Files directory
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
127KB

MD5
5da20ecb74d4111306b557aca98f4bdf

SHA1
1b2fd6afd992c6a23d7a53767ee026ad94c196fc

SHA256
eb90594d84b594385a4c3fe6a4f98576198a6af0e69f7c496db72426fc8b25a0

SHA512
cc408ebd3083f9eed4f10f1d08aaa011c12bbc23b9bfb699d59c209178bedb5c5680dfe2e42b4449daa6fd9602d0978840e4781577e94d2b8323c80e1a84c63c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
136KB

MD5
fe722fa41a1eaf63d5a31deaa92b5fde

SHA1
44d5409f2f7495e6a405da396a6d284a7b72e454

SHA256
2518957be11f9696e37b550bee183de6675bd8138bd88e181228440aa76bd28c

SHA512
20ffe5d63851a66ede399452722ea109bf0e31a27153f03c49f9ce9be80f0ad39447527b7a20a376f89057616e355447e7539c2c005b02c018aaadd4e959eb1d

Download Submit
memory/2284-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2284-358-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download