1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
Size

53KB
MD5

707c988b099cf8e159882d5890ef519e
SHA1

54cfebb350d80a4a1382d4f49e480e3d7de05908
SHA256

1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26
SHA512

b98d9826ee684e72e1948d106cc6b94e817697434f9fe108977950f68d53025ebb8edd61046293fb077f19db3522846b17daa855d853f913d2f0b74a189b17b1
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWn:CTWn1++PJHJXA/OsIZfzc3/Q8O

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3746) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2428-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000b000000012279-2.dat	UPX
behavioral1/files/0x000200000001048e-6.dat	UPX
behavioral1/memory/2428-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2428-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012279-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/2428-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lo\LC_MESSAGES\vlc.mo.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\localizedSettings.css.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe

C:\Users\Admin\AppData\Local\Temp\1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe
"C:\Users\Admin\AppData\Local\Temp\1bf7aa9aaea8397fe897bc93fd2866acbb7ca9cf9b47d1de55c482bba0bafa26.exe"
1⤵
- Drops file in Program Files directory
PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
53KB

MD5
905a1cd315e6fa4d862a428a2750c457

SHA1
72d3b8deb83158d65e1eb16576896828c69ee018

SHA256
8858641165ae19f74e98bbad2474e02f3dc4d026cfcf2fdeba9886f89a4230d6

SHA512
1de8eee5c88b0638c93284581036565d9624b814626c3c509de7623330c6a2aa7b610c028db5cb404b5501863356520bb165fab410f25999ea40ddf791da0113

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
18fd7cb2c2e55a65407d44094f23534d

SHA1
137e022fdc8be4d8888400251da05f125c495273

SHA256
b29371f1f0cc476b7d5721152804d89b2ac0266d92a7910068c60242174a1aeb

SHA512
7469986beeac11c7e65dec6eedd4d085ab842dbe96b85f7566a93501c73aa48462cf8721673e9737eb1cacce999364930101ef43787e318d9a00b902fc7423bd

Download Submit
memory/2428-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2428-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download