608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
Size

66KB
MD5

cec14728484a44f946f56a5d3986863d
SHA1

9282b74991d58bf34c0a80a275b41735085280ac
SHA256

608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5
SHA512

2bbffef5848b3b307e0e132d24674af5362f88f772fa69e28abefc957b51dc48de92994ece95ed4edbbfea601e9bae81ef1e3287d26ae4c77cd29d47cce6be5f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwABT37CPKKdJJxdPO9Ot6K/K2/R:V7Zf/FAxTWoJJ0TW7JJQOEK/Ka

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3099) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/files/0x000b000000010623-6.dat	UPX
behavioral1/files/0x000c0000000144e4-2.dat	UPX
behavioral1/memory/2924-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/memory/2924-162-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000010623-6.dat	upx
behavioral1/files/0x000c0000000144e4-2.dat	upx
behavioral1/memory/2924-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2924-162-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wake.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe

C:\Users\Admin\AppData\Local\Temp\608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe
"C:\Users\Admin\AppData\Local\Temp\608829dce933fbb775d60a92a5762f645ebbc253099e641c534c18230b137ad5.exe"
1⤵
- Drops file in Program Files directory
PID:2924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1340930862-1405011213-2821322012-1000\desktop.ini.tmp

Filesize
66KB

MD5
bc943240841f610bb51782b9f7735f88

SHA1
06063e596953e8ca8f34fd9134342a5f89383580

SHA256
67972c3efec746a51ba7050f691adb5adda70d1e0f476a6aa1984e1b4f17f7ea

SHA512
9cbb3da81b1d2067f6b5f125bf0c085e1af871db64e9f8ac818d71ec9f779cee1c92152a06f862a2aa5b213c92b91399f0074521acbe64a229e929496a8b1364

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
75KB

MD5
35c3250e66223d4a8a95dde55aa44ed2

SHA1
ca3f9da96cc61f885fc1d32ed9d15fe57daaa02e

SHA256
6a21723e611acd1fb7f331ec82c91641cba19bdc8f402fc6c25b1dd58e9b64df

SHA512
f1989a02d463b5a8525f3fe3d31804482e3440ab8d06bf1a214934a75648abf785015727e1d72e850aee142e7505266a4a2579f3de4e440638caf4c1735d8cf7

Download Submit
memory/2924-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2924-162-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download