607df6ae6cc50bed59186d251a29ced51c53c00aa61ab9b891317cc3fd7a57b8

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05342cf376aa4ead0bb30fd74e176270.exe
Size

53KB
MD5

05342cf376aa4ead0bb30fd74e176270
SHA1

d687796a3a3f65f9db389fa976473dcb24fdc871
SHA256

607df6ae6cc50bed59186d251a29ced51c53c00aa61ab9b891317cc3fd7a57b8
SHA512

74444505e97e09af2b64bec4da7bee00459e69ed271b95a98cc557448daa4f9e099039f4966467c6eac4a4d0a3662f175cefd5ec7121700de1f92b0e3047fc86
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJBZBZaOAOIBRBT37CPKKdJJBZBZaOAOIB7:a7ZyqaFAxTWbJJB7LDKTW7JJB7LD2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3719) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2844-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012115-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2844-650-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Mozilla Firefox\firefox.cfg.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\npvlc.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Journal\NBMapTIP.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_standard_plugin.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.tmp	05342cf376aa4ead0bb30fd74e176270.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	05342cf376aa4ead0bb30fd74e176270.exe

C:\Users\Admin\AppData\Local\Temp\05342cf376aa4ead0bb30fd74e176270.exe
"C:\Users\Admin\AppData\Local\Temp\05342cf376aa4ead0bb30fd74e176270.exe"
1⤵
- Drops file in Program Files directory
PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
53KB

MD5
ecf015726c33b2f20dbfa073bb81e912

SHA1
68846e5df87d3db3525bb56bf1a3215381c861b2

SHA256
6d0b8fbb3f00478fd300d19dbc2ac5eb3cb09ece69b733d1c7a74f6738badef1

SHA512
320e064d4f5b9e0fd87b6b891ca3c44eaf933a8f4aaf9717b6246b5b4b0706e9d69a5d2a1470040b2ba287c5edcba33f333bd2ee2492aaf69071f0aeca29f87e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
524b89a173bd5d41cbc6fd72363c9e47

SHA1
fcf08a514af937c1a924bec6b97db978a157adc8

SHA256
32cc66be5cfcb775c2d5329385d1e3f45f7cbdcb8f672887c6c5e47338fed593

SHA512
3490bc7fdbfd933f38b493134e9f597808904db3e4041f04f5c7bf5b5c50ee813e7069ed124a42c5303f32d658a778e31ee01739d065b2ec7d84e4a37ed224da

Download Submit
memory/2844-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2844-650-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads