da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
Size

58KB
MD5

2235fbd6bd9a0e2429346af7f39bbfe0
SHA1

09d703e50e57223d5beb57a7fa23d62eaa490865
SHA256

da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37
SHA512

3abdaa87606f73b93270408bbf993ffef37cbaa49240c4520fb014f6617fd6392fadec87965ca5efa6e887c5a8d20843353777ab3fcdba7d23d0f428e6315514
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYlaaGaa5:KQSoskRYA

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3732) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000a000000015c52-2.dat	UPX
behavioral1/files/0x001c000000010439-6.dat	UPX
behavioral1/memory/2936-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a000000015c52-2.dat	upx
behavioral1/files/0x001c000000010439-6.dat	upx
behavioral1/memory/2936-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\37.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\TestCompare.ini.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.msi.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe

C:\Users\Admin\AppData\Local\Temp\da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe
"C:\Users\Admin\AppData\Local\Temp\da8542e604117f1006fa3e7e28e134b72405dfba6afb97f1bb2fe70c07ae1c37.exe"
1⤵
- Drops file in Program Files directory
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
58KB

MD5
0fccf39c86c35c763cd10aa99942b3f5

SHA1
4a860f917db584cd38e0d6bd2d3cee50bbeef619

SHA256
dea9f54e47d3a2e4d04ca8ea0a4bc273428afda48922f412057e29794980022c

SHA512
843a0d117c93a2be30ebfe8fb479955f7ccc355ebc4039324d5c94d47263b40a57b361c709ce3d98828643d92b309345dc0b62f02eeccaf99175f24a6d6c1b83

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
8bca0d8cc76031bdb64119d7b1287dda

SHA1
ee47f22eee5693981d5e552c9d84dfa4d22b5656

SHA256
a92fe9193357958a99241c1e3633ed503a7cc3e075b838aa99aced65e710178c

SHA512
4beb8c322233efc822f0c391761d78e36e235a9a533d8d4c998b1ddbfd37b58da39ed43bd6621639fb232b1c7d3a3efc657a439dae043ba6861419c6c299c149

Download Submit
memory/2936-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2936-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download