55e6fc0dcc71903b5eb169c4b52373d7e45d0d51e58e087245839ad7cb03088e

Analysis

max time kernel
108s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2480c9e4eb0ac172b0f8680a9ae78450.exe
Size

94KB
MD5

2480c9e4eb0ac172b0f8680a9ae78450
SHA1

c50d920732704d74bc13b7592445e87d80914570
SHA256

55e6fc0dcc71903b5eb169c4b52373d7e45d0d51e58e087245839ad7cb03088e
SHA512

ca0beb75574d3c85d7e5f601ce60ab23242283cc9ed6614d91598781f4c35cf6eb2335a7f2a99c6423a5d0ec55bb4dbe6600ea212199ba480f97f01afae44671
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZuEd4HZKMSs9w7WsLhEC7pp:KQSo7Z54HZKMx4dhECVp

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (228) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000016d58-2.dat	upx
behavioral1/memory/2816-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2816-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	2480c9e4eb0ac172b0f8680a9ae78450.exe

C:\Users\Admin\AppData\Local\Temp\2480c9e4eb0ac172b0f8680a9ae78450.exe
"C:\Users\Admin\AppData\Local\Temp\2480c9e4eb0ac172b0f8680a9ae78450.exe"
1⤵
- Drops file in Program Files directory
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
94KB

MD5
86818456d796f3062b8e42dfbcdd050b

SHA1
ac36c4cea433cdecf7e4d592fc8ed1ea764ce9c7

SHA256
c840d25d27f858b4d81fab058f99f62b5e9d654651b55c8be831c7a0785ea958

SHA512
e0bceab00d5a976cbeac5b26667c62b29e0ff21b36e83d4458d18035293944c4e4bbb0d810596ab61a24195a188468b537180ae1627ed5becc7a0159aa35f09d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
103KB

MD5
c1f86b0a38fca39502353facbf84c7c1

SHA1
9f00110d61f568f4f1d497b88c5764909886ef04

SHA256
f1cc83be0e8a712939f90b9695e220cd4d8e031fa26cf5380dddad884519d919

SHA512
f389956cb79a4b1c536d33e53dcd2ae5689fd84b713732d31cf53e46bcaa2ce4e0ab6c810a96a6957333b741975fb2ca312856afd5305099dfe7c4cb26c3a62a

Download Submit
memory/2816-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2816-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads