19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
Size

117KB
MD5

3b278138c0e2ce7ad53f83bf5c005420
SHA1

062d7dc5c6a185b2281e74d205398b668aa425f5
SHA256

19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97
SHA512

72600b71c29b90cf4ed9c37f87c79a35b5aed8562a0673e4156eb9bf79cc9f2e3ac4e75e8d3a69f7bb386c4a1cc1e71db2a501b162d1a81be046718a5ce64d76
SSDEEP

1536:V7Zf/FAxTWxOmO/fxRfx4KO4mvRIlEyIinkuEKo/mpFUbk4RRV72:fny+Tuf7fiK7mvRIWXiqKkKGbTDV6

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d0000000143fa-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/856-650-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPSideShowGadget.exe.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPMediaSharing.dll.mui.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll.tmp	19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe

C:\Users\Admin\AppData\Local\Temp\19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe
"C:\Users\Admin\AppData\Local\Temp\19d8d7a9ea9fde0b8d6285dfef00cd2799c53f85bd8bc162987660c2c580bf97.exe"
1⤵
- Drops file in Program Files directory
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
117KB

MD5
f968173016363324215a9f40be54b3cf

SHA1
e1720ad9edd35210988e09187eb5d3dbc1eb943c

SHA256
df3611926199a029115f68a745f122f8b09e2664007bfc3f69cd6b6fe1ce1afc

SHA512
e3718a81e203373966ba63d0917353cb043ae24dd61887302b1d749f738a95e70e935bbeff0b5e1b9805105d0718dd010cccd1fbadb27d989cdb8a9174a1ba99

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
126KB

MD5
6323e838ce60bc261448d3aed13409dd

SHA1
b27f889b4279896905f7b7088e4fd6b7ce648ef7

SHA256
d7fa72b433df5fe218752477b2ad67cf65215dbb3cb0cbbde0bf66b61f9d664a

SHA512
2d24afae99079709ac0f6762170d1391e5d26d2848eab823c3792d2e5099e38bff6e9a8ce70b72cb8fb96e572946646b69be68590719ba4609b47a5c9f139017

Download Submit
memory/856-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/856-650-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads