142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
Size

53KB
MD5

b41a8e5568372006d0e782150864b432
SHA1

8ad9deca972a08e33d3d54e44c06d5595ad9365c
SHA256

142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108
SHA512

73066d99482ad42fc5f49d43289cfa0b73f1d81e5176d96dca12025265ed4b36621aaa72463a06d7faf12a6e7093a7d425a175a90771d139c62894bb6fadc70d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WZCqCDhC:V7Zf/FAxTWoJJ2WjWZCqCU

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3727) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2948-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/files/0x0002000000010667-6.dat	upx
behavioral1/memory/2948-662-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_msg_plugin.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\cpu.js.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\redStateIcon.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\AssertExpand.wma.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe

C:\Users\Admin\AppData\Local\Temp\142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe
"C:\Users\Admin\AppData\Local\Temp\142da05f6dbcb3f428ffb760a262b77262c661f4566463f97b2ffaa298e08108.exe"
1⤵
- Drops file in Program Files directory
PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini.tmp

Filesize
53KB

MD5
db56d2e551fb532c0a4724c2a01e6f3d

SHA1
5b33f9e67dc97defe8e9cfa88d94717bc10c839f

SHA256
ea34c182e91c1adc6f90fba52624f8ef32b2f01dc7be1c8f3db91c1db1c98b7e

SHA512
6c39cca3fe16473c11af010d68df4cbb3d3778c416d7bc89c2b9e6ae0a7edca0c51778a46b48577fa9fc6e098e3eea2e46d7066adcec7979ffe75f7e8807b7ad

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
eda014f208092a9f819ce368d6780352

SHA1
829c0f6b077b51276ff85a5305193fe192297a25

SHA256
d0efda0565e48e63ef29e2498675b97480030fdfa24021f9663eb380775f8419

SHA512
16f8c85b09edb1a7689e7a495a4a3c835aca8f4da8ca718441050c3dcdf46ed25d6db1362096e9c44a20afd34fa1f8560949bd55ee67066f7051e77af005eec7

Download Submit
memory/2948-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2948-662-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads