7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
Size

69KB
MD5

2745ec18140731a2c3ded824a8b9ec19
SHA1

93311268119672fb20aaae9c3b89eeea62ccbba6
SHA256

7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef
SHA512

79fa1174c4b9bdb1779dfa1542ce873b181eccb1e1b94b65a077eabb16a327924a238e97b3442dae40997b57ab7e253ea47a37c4af8c6b86f25fed6e7f972d4f
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxb:fnyiQSoa

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3730) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000d00000001226b-2.dat	UPX
behavioral1/files/0x00020000000104aa-6.dat	UPX
behavioral1/memory/2716-656-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d00000001226b-2.dat	upx
behavioral1/files/0x00020000000104aa-6.dat	upx
behavioral1/memory/2716-656-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp	7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe

C:\Users\Admin\AppData\Local\Temp\7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe
"C:\Users\Admin\AppData\Local\Temp\7da129d869cb3f85d6be613522e4bdbd0da22e7e99b1b86b3f713a2020c718ef.exe"
1⤵
- Drops file in Program Files directory
PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
69KB

MD5
317966d305e336dac2b8492eee2c27a9

SHA1
975b48c20db282bf5a1b585e00bdf0f8bb25e407

SHA256
dbd1590def93a8ab1aeb2dc858d7dec8ca109b2ae520e3016cb34ac260e5f7da

SHA512
425503617fdde7cb664d49d297dcf560e6859656a848e267012990af9bd17e013d4a039c173b2edb991e2c3defa3f4db0168db17e570ff8bab524e571ecc2403

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
740146f5d41b119bfaaf6d380295965c

SHA1
855978c3b859b6e18823927c7d57b4f195e8979c

SHA256
2bba0e5ccaef237212f584760db1221c458e1b55f65912e47317863412b31800

SHA512
d251d212714f3c4f0151d7e307a1829f563bdac11c8ad9e908754e469d6ebc9832efeb9ab7bfaef980dc9b0179584042585fded5461a4f45af762ebee81c8645

Download Submit
memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2716-656-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download