899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c

Resubmissions

05/07/2024, 22:36

240705-2jc63szgkb 9

30/06/2024, 23:59

240630-31zxvashpn 9

30/06/2024, 23:55

240630-3ym59sshjn 10

Analysis

max time kernel
143s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
Size

90KB
MD5

6222154957fbf89f273719c001f82a6c
SHA1

14a13a772f654c8d46de97e56db3e75ffaeb86fd
SHA256

899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c
SHA512

6bf4e345f1ac322a7fab6beca852765ac369b7bffd6007b272aa5458f4c354804f891a4aa5d22c4fef60dbb5e0e5eb37645bfe98413f4de91b8e925294d13af0
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8VCnXxX81jmQJHdJHr0GUykUyN:enaypQSoPXxXTke

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000c00000001226a-2.dat	UPX
behavioral1/files/0x000200000001047e-6.dat	UPX
behavioral1/memory/2932-68-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001226a-2.dat	upx
behavioral1/files/0x000200000001047e-6.dat	upx
behavioral1/memory/2932-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe

C:\Users\Admin\AppData\Local\Temp\899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe
"C:\Users\Admin\AppData\Local\Temp\899f9eb14b629b413d8fa84dcc1653fa2477e8fa4e4f119cd02dab78f9e7a10c.exe"
1⤵
- Drops file in Program Files directory
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp

Filesize
90KB

MD5
8e2734ef214b44c0141175bfb6d8bd5b

SHA1
a7e2132d149e9f8df0075b5547211f51e0f71027

SHA256
54a7b21ba94eb399ba74800ccc8ee4456df5425ac54120984d605b8b30550599

SHA512
9c2660a7a6087f5d28210927aa211f7024775f129f48e92470a7124da4f9e07bb800a2ef44657b9ae216a7b370f377ea0db54970c3c835909263724942dca776

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
acd3bc56fa8a5208fe31f9f3953f9bef

SHA1
e689bfc778c0f1d26a67adafafd733d6f99fe268

SHA256
e340bf08a7d3db7d42d2e00bc2da1aa4f4a608f593177629a12ea1760c8c99eb

SHA512
134a32afd9c1b139c9c71e919bf3edda35f9ff54fca63afebc2718805e0566cfe5a71d5b4252be49f0e61486c5a6c40db9d15fefdb8a5f16b26a23559416f146

Download Submit
memory/2932-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2932-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download