1fa22510bdb65cf80e2fc5bf2f8f7238125afe8d0154c581c51a070138f196f4

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32edb5e4fe99e43027511b03a14e28a0N.exe
Size

100KB
MD5

32edb5e4fe99e43027511b03a14e28a0
SHA1

0ae25e9ba955174a0eee4dad7edab626308702d4
SHA256

1fa22510bdb65cf80e2fc5bf2f8f7238125afe8d0154c581c51a070138f196f4
SHA512

61ae4d3dacfdd40860f09174d2646e2e53bc1bd809fb4384d88c50928ca2de36061a892955ff6fbf30903c19c3459caf03e1c2430f6f80e07b55af15a558df65
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulF6v:enaym3AIuZAIuyxJrQulI

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2712) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1708-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120fa-2.dat	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1708-398-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\release.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	32edb5e4fe99e43027511b03a14e28a0N.exe

C:\Users\Admin\AppData\Local\Temp\32edb5e4fe99e43027511b03a14e28a0N.exe
"C:\Users\Admin\AppData\Local\Temp\32edb5e4fe99e43027511b03a14e28a0N.exe"
1⤵
- Drops file in Program Files directory
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
100KB

MD5
745b3852e33f15f80c52b66e686c5ead

SHA1
cf3c17931c110ce49a2bbf3386926b43a74ed976

SHA256
5f51ca46aba06461d64c4cceb523f044cc4c900aed2c642ddb228e8575855568

SHA512
5a2730cca7dd8d93c32d9911592d368c76cca41d6ff7735fc1e24332cee3f180c4fbcad23fb818b7c3861f0326c6295ba9b3fbf37323ea5e0e62fbeb1b31620c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
852c969a73023fe3ada5c8df93a2301e

SHA1
71874215ea1726aaf6b610e2eb75506cbfd9d780

SHA256
ac1dc7453a0fd9d051ad83e1603f88bdf3eb9e107a887160737639c2e9be9fe1

SHA512
9fc7dd207421c11a6a384a97bcba41e2978f9a4216e79a477508161d0aa598fe6366b42d993ec584f5998a257220e5c4eb9d27ebb0a78a3dd8121d5bd600ce4f

Download Submit
memory/1708-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1708-398-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads