30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
Size

92KB
MD5

0957c2a81aeda2af436ef6d4281bd11d
SHA1

0d8c9b45aeba6a3dc422cd15d225b1ed6c8399b0
SHA256

30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8
SHA512

444912811ff16a06e067f1b8a2cd59ac0ab2d3402fa186bd0eb20fad6146fcb234a1d757e71325950842bc3471c0fc57e88f875ddf0a37644181cf512aade3c8
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOVYd7n97n4:fnyiQSohsUsKY5Z4

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/2192-594-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPDMC.exe.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Journal\NBMapTIP.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe

C:\Users\Admin\AppData\Local\Temp\30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe
"C:\Users\Admin\AppData\Local\Temp\30b46ea382ea75a92651096439ecf1672d0bfd38476f41821a410188e0dbdba8.exe"
1⤵
- Drops file in Program Files directory
PID:2192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
92KB

MD5
bf1f0337b1db04e10e7f1d1ea2a66aea

SHA1
79162bda9038755f6071c4eac70d28b1d93539b5

SHA256
09fd8af893648c60dd6ff5ab8fe40e65c8f0a5b60a0157ccad5230bf4c8b624a

SHA512
189bec48ce67ef0812fcf9d01c228d985a562b0e35cc08620f7668b966828931d98347e2ef432a80e146d6a2456f1ffa38d144106d096dce9a013cadfb9b9f5c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
bad307af171af224ac680879b6e5bff3

SHA1
176cc36838974e0fb4729f6eb87a93b1f800262b

SHA256
190fcd4028f1139f9ce5f917dbe7f51da1b7750979e9f7afb56386bfdb78c76a

SHA512
a63265a4df9f7055af1422d95f73ef0208749fa0a150ea55114a597abd4f964013ff6272791a7c0959fb73430ab44e8f6d89295180368d27db90e7d7454862aa

Download Submit
memory/2192-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2192-594-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads