4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
Size

81KB
MD5

8ea665e7693f49ce6d9f1c14b2b34137
SHA1

637b73064914971d25d31a5c5de3e194db442d45
SHA256

4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184
SHA512

858b28340b52ee678b8d3d2b052826d2343290fa45822e938773680a4d88874567fca736382961b9895cdd67aedfc7a9c6b868eea8b33baedce01a6fe766e5cf
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJtC:enaym3AIuZAIuXJ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3504) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b000000012258-2.dat	UPX
behavioral1/files/0x000200000001048b-6.dat	UPX
behavioral1/memory/2188-654-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012258-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/2188-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe

C:\Users\Admin\AppData\Local\Temp\4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe
"C:\Users\Admin\AppData\Local\Temp\4d308fd12a37cda6d9e373731e1f4e18d18abf4d58306ebde6a8d95188e41184.exe"
1⤵
- Drops file in Program Files directory
PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
81KB

MD5
312399bad0f5b7f5e32e73af4d1623b8

SHA1
46ab1154747c9b5f8c733f7534b47c869b6ce27f

SHA256
1825046c180179c9223ba804ec83dac4ba94f2d8eda34d45454430d7b405b399

SHA512
53ede3d28345c7023f89e23093e5defc4a9151b3f73ab858813a3d276de35a341b955d0afabf77019ee9fe8c1187836143a6b3c3312faf5f9a4fa72df8ff00d6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
7e2cf97964e8e331c3c3788544a521cd

SHA1
df05a9b76961210f52761cbeaa707f04accecd76

SHA256
1cf3f50b34f7921f4e73fb8e0e437c1534c25d639992b97fdc6cae1e0fdb02bd

SHA512
4d8e9fab596d41a59e6c8402ef25e9884a9d951e2b982f01e62efecd9a676d44079bbbf9c203c8928a23961e82e2e6beca0f99eebc8209b55523a0e562222000

Download Submit
memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2188-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download