f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
Size

57KB
MD5

635e6858cca679d43bd3abe745c0b353
SHA1

0e08cab369a088de56b5cb8e580d008bf87f4dee
SHA256

f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf
SHA512

516b30720afccddfbd431e7be9be328518f11b9da14ebffd078fdacdd8dd1ecba8707f6af125b6be9219b830e2adda066ecd0e0bbb12e5c91649ad14fc1e442b
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFJ:67Zf/FAxTWY1++PJHJXA/OsIZL

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2855) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000013309-2.dat	upx
behavioral1/files/0x0002000000010679-6.dat	upx
behavioral1/memory/1724-102-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe

C:\Users\Admin\AppData\Local\Temp\f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe
"C:\Users\Admin\AppData\Local\Temp\f00a160da3cf09713b66a5ebd0f0c67610b24e025764d415d2c367888f4915cf.exe"
1⤵
- Drops file in Program Files directory
PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
57KB

MD5
04acd8024a2c0ef2c7d0ba116d211e5a

SHA1
ba177bd5455cf4a4c3a3ef572c8b169a015b028d

SHA256
0311559da746f67fa77b1deb81e16bdbdcc9489692cd660994acdfa232e7cc0e

SHA512
0b8b6aa873e8b07a6e171799c3fa68c2482d13fa14d5c81fab36e515666b49251e74b5f0c98fe555ae6c4e9f3c619c7c2615407efe54de9a41896f1681178b9f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
45c946b546213771109cdd98b8a987d4

SHA1
a51b219b41c4bcdfb9aa7219f1ac2ea9eb4ae345

SHA256
912235dd9621bd06a591b3473bfa9c55b55e0bad78a0315a6574158553399cd7

SHA512
992ce15985b5cc0833d78447b3e647f0e3e2465b236667a7ca11b7bd919f36ef08cef6c837875f92310bb7c0a77d6c4b2b28d0c7b731217770e3d718073c83ff

Download Submit
memory/1724-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1724-102-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads