Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:32
Behavioral task
behavioral1
Sample
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Resource
win10v2004-20240426-en
General
-
Target
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
-
Size
45KB
-
MD5
08fa023a614800c5c2096b5b1827996b
-
SHA1
54a7ccf761a1f0d79773289485d2f0452e496c9a
-
SHA256
765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697
-
SHA512
523e415ae8dba0f53cd7c3eefdb26796e1b521edc295b8f9834173a5385cd131932427b63f973c93adafdd66ea50801e5b7eac9af078cc43d5bafb5a9c809650
-
SSDEEP
768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzb:CTWn1++PJHJXA/OsIZfzc3/Q8zxp
Malware Config
Signatures
-
Renames multiple (1076) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x000000000040A000-memory.dmp UPX behavioral1/files/0x0009000000015c5d-2.dat UPX behavioral1/files/0x0002000000010481-6.dat UPX behavioral1/memory/1908-26-0x0000000000400000-0x000000000040A000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1908-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x0009000000015c5d-2.dat upx behavioral1/files/0x0002000000010481-6.dat upx behavioral1/memory/1908-26-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\System\ado\msado20.tlb.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp 765ca22f9dc37369f052941987ba20ae5c51b9409d6ed05cfa435f0b7ab0a697.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD52e3affe3e70ceb6132a91e268fd0851d
SHA16045818a3cd35c953d1e2ee2bcb4102cd49f0141
SHA256c2f57170d8be246fec10832581996ab187f172b3a15fdd364f49454c151ffe4f
SHA512f875550e085ae44e8a03eb08fa102ca360dec3817b609e93b72761cdd863fa9f8f2d93e3ae5e135c517571bd9522bec5e0fecd7d9979b3d94aef845590e93260
-
Filesize
55KB
MD5f760577161fafdd7724099970463fd14
SHA146d2342d300cd42b3cb3f7eeb480566b386f7d18
SHA2565285adc2d333a40df794f80c646e8949824a0d56843938291a2a60642a19d49c
SHA512d2c1553bcb5a918e51cd5acce768e2dbad1bd446dfe87af0e57b94b87d9e41cd1fbd0d0ba6ce76342b948e807340c02542fd00e726c8edf8fe6240248bfdf657