Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 01:30
Behavioral task
behavioral1
Sample
a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe
Resource
win10v2004-20240426-en
General
-
Target
a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe
-
Size
81KB
-
MD5
497c7c5ea397a56d968144b98fa980ba
-
SHA1
c4a02b353c9eee4496a7f91832c8eb8b35e2ff8b
-
SHA256
a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4
-
SHA512
c8ee7e1c8114b60765437b707ec48f5cc5ea6ef05318f547f2ed841c6f9f1785048d519cc64271f604b68bf036522beb07bee284499ec15a356561f53c7c651b
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2Ip:fnyiQSohsUsWU9BK3p
Malware Config
Signatures
-
Renames multiple (517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x000c00000001445e-2.dat UPX behavioral1/files/0x0002000000010481-6.dat UPX behavioral1/memory/1720-62-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral1/memory/1720-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c00000001445e-2.dat upx behavioral1/files/0x0002000000010481-6.dat upx behavioral1/memory/1720-62-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7-zip.chm.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Internet Explorer\F12.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp a5d02a3c77893f315515a4204243fb9197f12b99e09704d20ec5fe115716acc4.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5c51262e8b9546dd46f18e2655c7876a1
SHA10ed00e778d8e22996bd264548b167ae63d760dc2
SHA2560ef28376b5707f6a112881dd9fb9cd356dec467381802ee634f4d99d631e3315
SHA512a915b86923a6a78d0e5de93529e5d830cee96aadc19ea5d1652b09a772196e3bca48bda31d1093ff6f80f3d288c63f567d4934460bde4bbda2316fead2901d75
-
Filesize
90KB
MD5d803040f37b315b52622c01094ae4e19
SHA118b2e8ae2dbf7984866a63d50968373fae4b9f2b
SHA2569dc9f1aba1aa996145b248ae26fe4ea90e673468a9f8400a06e3b8720bfcf04d
SHA512ba5ae87a4745d29611ccc9b490ceef425fe7de4e7569c1da409b2eee8d4d5bfbd9fe3709144959d1f89edc2fd7a5dfc1b5cc33b606d9c2d0f9abfd43cc2455e4