6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
Size

82KB
MD5

a64640028f2f93f486120ca4d21dedae
SHA1

af1c741e1b41771ee0b358cf9f8f66b90fe4a1e0
SHA256

6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6
SHA512

ef802bd320dfb8d294f3a134e86ed78a299afe4a9b560c002fc44f382bde5f5b3d36675c73d9607b7ceb65b447d0607de3195b545c4c72242f181207760e8cc3
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Q8/8sYcgYcj:fnyiQSoskz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b00000001431b-2.dat	UPX
behavioral1/files/0x0002000000010679-6.dat	UPX
behavioral1/memory/3028-176-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b00000001431b-2.dat	upx
behavioral1/files/0x0002000000010679-6.dat	upx
behavioral1/memory/3028-176-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe

C:\Users\Admin\AppData\Local\Temp\6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe
"C:\Users\Admin\AppData\Local\Temp\6326a700f3bd449fefc1691ee4b9f64d870f352ae5f299d63df0d21b10c790f6.exe"
1⤵
- Drops file in Program Files directory
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
82KB

MD5
8c124f8ebc2d19b0c61dafbc2fdb757f

SHA1
65ea02b715dd5cb1a6625007f099b54d92b7c5a4

SHA256
493cefc9de417684ec200d45ecec86e647d40ef708b1d1ea795c80507340d9be

SHA512
686dad0a6661305f13b3e8e7b0d8bbacccf60f9d539843fab14f0beff683d9f2f1870bf26b2b88d7878e1be84183389a351342583183f98e444eeee47cd14128

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
6f464a9c46e521fbab3f19043865faa3

SHA1
fdae804fee8ddc6e370a58f1936b01349e51189d

SHA256
90118c2458e00d5e69a4484c6c6baf8a13bd17491f258580bd7bb660b7ff5d2c

SHA512
d44e0b7939c2457da083080ec9722df4a22e8d0e6270e57e8d66a63214137dd32967f1cc8ea695f7ff1da7d167042daf99f62661161007a187b617a0c3f7e055

Download Submit
memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3028-176-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download