389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
Size

71KB
MD5

43aa270c00da9f6643a1397e854607ca
SHA1

d09eac665bfb0c3d2bca1003e76e9ef16229fec3
SHA256

389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b
SHA512

f8c05f63e90f821eb64c5f432df1f3b0b90a7b34eff26115f6c04c8984766a46f65d7f0b39bde9697d5ce02a7d9f66db6205e1b2b3e6038245baae73df5546e3
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx1:fnyiQSoQ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (556) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0009000000012280-2.dat	upx
behavioral1/files/0x000200000001047e-6.dat	upx
behavioral1/memory/2980-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe

C:\Users\Admin\AppData\Local\Temp\389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe
"C:\Users\Admin\AppData\Local\Temp\389ae62f66458001ac0c17b55b5a85271b02b02094ab6ea61c9b991a1f0e203b.exe"
1⤵
- Drops file in Program Files directory
PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp

Filesize
71KB

MD5
0f9fe94d3cb6f45f0187dac7458290e2

SHA1
f6ee30782fdf49446060fddac9e72cf5f12d9e95

SHA256
4baab2d3f8d1e140e13a0c702dff02ae8a43b1f4849948a5b2ad7e016414a879

SHA512
6b3121c720e4a13b18a72804c69cf51e96897ca06edf486bf952d721806cd71264bd0e86d12ac0ea7eae2408113d81f0fc1a1c1cada829d0f14a2e331c41ed9f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
afb05d3cf217903f5e26f81faae1748d

SHA1
5c9e51849e45dbb73e791f09384bccf10565020a

SHA256
a6cd2d6fc66c067d35f9f7dbf380f2d350ca60d74c16e7ad28cd776d4153d4bf

SHA512
383e7df7f2b411532e34a248d81a67b029e514074ebccd2686cc0c1a42524f0c4c93a53af44d8456eb88caa010defdf8ff64275715af3f01b203f5fabf871a77

Download Submit
memory/2980-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2980-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads