6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
Size

54KB
MD5

2ab747375ced34cfb1d62527e37f36ae
SHA1

d36234808c9a9369d474d02ddff176f5e8b2c0bc
SHA256

6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf
SHA512

8da8123a772a9e746c8272e66a87513e649926dbd2ec4c43d680a93853b4d7619fb87a6c2bbc687fb50f87a1ffddeaeacdf1250597e178883f0f031403b8c774
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAF42:CTWn1++PJHJXA/OsIZfzc3/Q8GF4

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3748) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1944-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000a000000012280-2.dat	UPX
behavioral1/files/0x00020000000106a2-6.dat	UPX
behavioral1/memory/1944-86-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a000000012280-2.dat	upx
behavioral1/files/0x00020000000106a2-6.dat	upx
behavioral1/memory/1944-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\slideShow.js.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\localizedStrings.js.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\settings.css.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe

C:\Users\Admin\AppData\Local\Temp\6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe
"C:\Users\Admin\AppData\Local\Temp\6b3b7a8cd6ee78e35335de92a56c7ee18ddd04f08b371559606549498b5db9bf.exe"
1⤵
- Drops file in Program Files directory
PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
54KB

MD5
a9bb237b11e5decbcd25073305dff633

SHA1
45dc2a36bda14e7c65c95568718017eeb79a5fca

SHA256
9054810122d8d9ee20ff71ee5dfc0712ad815d411ae962e2408b8c1e640ccbcf

SHA512
5e2f2e4668621bb0f2048eed90744c318403bd3c780c8393003ccf6a09710c9f2b94e41ab40ccec8f57cb55378e4df16031e8c65536d0382c2736304a9d75531

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
0fc4d672d8c5eb9dd53887570a95fb46

SHA1
912bc2dbc1cd9d8f2a06db426d8cd047af7e84f5

SHA256
6b31ff673526e21ae779b7ebed9381a6af24ee7e9ed79b95666282489e0cb400

SHA512
bda803619379e2259a2ce96b0a4b5369ac4a7719a99f5d32fa2adc5f1fb81c13532effd14ed96dab218b68bbe9e96fa2a7cb725a342cdaaf9b18ec9f810a5483

Download Submit
memory/1944-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1944-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download