cff021ccf38040b2fd04ec6171b8921ff4d5719cd3573b2af5da0db86b3aff70

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
Size

99KB
MD5

191c0f94443e9c74f8e2b4e78dcf4dd0
SHA1

05b7e2be0e8baa364b3aec2b48aff7ebf662d06c
SHA256

cff021ccf38040b2fd04ec6171b8921ff4d5719cd3573b2af5da0db86b3aff70
SHA512

bfb350ce2ce36a9da8f3253133c1ecb797accce3e94e3f885ba2f013aea5b7d2a53ece49af5817028ce6916d58b5a29bd99472bac953678fc8d939c9fed580c8
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulF6m:enaym3AIuZAIuyxJrQul9

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120fa-2.dat	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1908-642-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Dublin.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	191c0f94443e9c74f8e2b4e78dcf4dd0N.exe

C:\Users\Admin\AppData\Local\Temp\191c0f94443e9c74f8e2b4e78dcf4dd0N.exe
"C:\Users\Admin\AppData\Local\Temp\191c0f94443e9c74f8e2b4e78dcf4dd0N.exe"
1⤵
- Drops file in Program Files directory
PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
100KB

MD5
c50826bf5afd551fc11c4b9c59c74254

SHA1
a77776407e2ec1df8ac901f7ba80ed52ea581752

SHA256
7f833c6235ac13283a6847b7f8b4da293b723afbfad050a777d46b468e36441c

SHA512
2676650cec4d28293db84f0ed75aad50c9b3b44824a6107adff68e2684e968813f378e91bd417b365503fb7ec01133e3369458267ffed560ab0b073d543eca26

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
108KB

MD5
6aaa56928791863cacb7760b7743df14

SHA1
cbe9a1d4fcb3e95a39e5199757c94869d326876c

SHA256
39893736993cd0c77e63d4928d93eb8c44c208e722553f9c6850fe030996e4b7

SHA512
f365dca03828547c1792330f425f974f340ad32471aa332ed4e7cd1f6377c25f109acef17d7dd5f5d9cb8ee7b872287046aecd19bc8ed01d63d50eb8f5d8920b

Download Submit
memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1908-642-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads