9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
Size

48KB
MD5

cc3be63767108d1ee534a513c081dea9
SHA1

276b5318a919fbb41f41466f95b467847f22600b
SHA256

9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d
SHA512

6a1ea72fa4cd4d220eb182c09de0b2fc05d1a0829255fee4ccb114ea9cc753eca588d8bb1fdbd3f505dc94e4f5c38e0bad0ef5ce368fbf0c8fa2f3ef38f76476
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzK:CTWn1++PJHJXA/OsIZfzc3/Q8zxDCuy

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3708) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/620-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000c00000001226d-2.dat	UPX
behavioral1/files/0x00020000000104db-6.dat	UPX
behavioral1/memory/620-80-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/620-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/620-80-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgaussianblur_plugin.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe

C:\Users\Admin\AppData\Local\Temp\9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe
"C:\Users\Admin\AppData\Local\Temp\9b04a1b6e644c5d6f383e59773aa958d22ec687ccf651d5ba46d125057f2665d.exe"
1⤵
- Drops file in Program Files directory
PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
48KB

MD5
9d5b999f9d213b55d9257a88f7cf5c0b

SHA1
30935df4d84a336e7cc9d053b246768bcc37b098

SHA256
646c5b2f395db866a77416bd369ecebbc0ccfd7d23918930e7cf24ac01cdf991

SHA512
c09e1f4192ca6f8437b61e416f346f77ea6e86d0bd58ca60acdebb574fbb49e8640ec054afb4734a8c135431ff1038496228a1ed664981af3e08ca74412694df

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
c8d2b19a0c71ecd8d8e77081ab8e0c4e

SHA1
1489320df9b44436b1025bfe81bb271d51576d71

SHA256
83ca20c96001742ab8aad07f94bc8ccbbd414f9184b64733a8834170e9133a2b

SHA512
2dbe921b30c68775b19e229d83b8fd0705703408886c708655c05cb6dda77b05ec13f8cb976e7c0182906940de79ce9f76848230d002319906bdd38b87efa397

Download Submit
memory/620-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/620-80-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download