fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
Size

46KB
MD5

7445b662b27b48240f452b24f42f2ef9
SHA1

c6fd8cafb3c32fa2ed00be9b7fcc83999efbe920
SHA256

fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53
SHA512

2087695ac28153eabf97a259f822e66d21cdff89bc8379bf7f71be1e5d69e80e33b5e303a55b49fd25ebfe4d5b54caa5824b7788ae82ffd3dd9765260b67d0b2
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzT:CTWn1++PJHJXA/OsIZfzc3/Q8zxJ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x00080000000122cd-2.dat	UPX
behavioral1/files/0x000200000001048b-6.dat	UPX
behavioral1/memory/2172-82-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/2172-82-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Mail\wab.exe.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\weather.css.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe

C:\Users\Admin\AppData\Local\Temp\fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe
"C:\Users\Admin\AppData\Local\Temp\fb1a7f96e5c3e691b211b4f1d87ee47a23cd29349d0aa4752839190ab3eefc53.exe"
1⤵
- Drops file in Program Files directory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
46KB

MD5
94b4eff8c1d94f06605d073bdcca5dc6

SHA1
74da8fa48841039ba8002d95531a2ac1680ddce0

SHA256
dc6bd67278dbc4151d7cc6be9a76af64f0d474702c8449c00285556fa97cb2ed

SHA512
6c47bab6d54697accc1ff6158ede19f99034b0de61ec6fd69b24f218c08566ddcc0d224217b6d61afc885ab630ee82b378cf95f70fcc3e88dd7afdfe98b3c7db

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
9eda47fa68332b48f998188b7f50d79f

SHA1
94d6db06f99e119188d8e8810b0b6dd8d88ea06f

SHA256
03af795bc071b3d8c5635b74d7fd7f27d65a9af4c76fe3a41567eff46df51f97

SHA512
9f662f5175264bfee6ebac0d5d43bc2ed035d651a75f1d80b982f262b77bad4a9df041cdaf736458b47ea89cc2452f8371e41e1a2dd701d4a3076198c4163818

Download Submit
memory/2172-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2172-82-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download