b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
Size

41KB
MD5

4db652f9787522234fb392edfab0a146
SHA1

c813bfdf7f5a9ed224887733d538b45a63b03be7
SHA256

b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb
SHA512

b70d0f7ec969ec17cc4ffd4b45a2b7a26f60fc02e5acf0656c7df3a3b2d84ea20132cf79b167d97aa2549026d511c966a40c7c34836b9dd83420ba7f132b5d72
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WGoj9COieQJfoj9COieQJw:V7Zf/FAxTWoJJ2WjWpf1fP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3689) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000a000000012286-2.dat	UPX
behavioral1/files/0x00020000000106a2-6.dat	UPX
behavioral1/memory/2280-658-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012286-2.dat	upx
behavioral1/files/0x00020000000106a2-6.dat	upx
behavioral1/memory/2280-658-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libclone_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\localizedStrings.js.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe

C:\Users\Admin\AppData\Local\Temp\b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe
"C:\Users\Admin\AppData\Local\Temp\b084380317d9f3c8290d9fb0635c066c88ed7798b87ee5fbbcd890e32f7218fb.exe"
1⤵
- Drops file in Program Files directory
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
42KB

MD5
39972511a52bbe8c1cbb7f9306ceb124

SHA1
e15f904b4bb17f442e221872b16f169df8506885

SHA256
159968c5d5da285a9a913319819654d8eb128788839b0e0e20c7835a753ba38f

SHA512
d400c1ff36a61a7098954d6999f9705029bdf2dadd4aa0648c5245fb79e53041471e9aa23b486a1e2ae2c7bcf2abb8fa0dcf1e4e2cb82a9f560bef1d5aa01b59

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
f9ef4eab33b719c771c00c5dfce1f3c7

SHA1
d77758dcc18b1b99d0bef1f1359c62735d4661ce

SHA256
093884f773e9149b1eeab80e5b8c457662f8b0a9c514f481ee2607dd78a50988

SHA512
33665e7688546cdd0996aa6e7de0473eba111d3a761486e2cf936046a592581be186c17b082569f95e1884e183fa75896d326cb785bc55c4590e422eb9a162e6

Download Submit
memory/2280-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2280-658-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download