d8964af4bb05de7418bf405dc4eb51430186f064a67efa4583b5832eef087556

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8719d39764be1b7edf8fb88c4f43a900N.exe
Size

48KB
MD5

8719d39764be1b7edf8fb88c4f43a900
SHA1

2dfcd5d6eefba97d8d6d7449bf3e79117637409c
SHA256

d8964af4bb05de7418bf405dc4eb51430186f064a67efa4583b5832eef087556
SHA512

021b41484549953269f3afd091d52812e26fcc289cb72544f3339375f68d21debf28889f153cb51c330e52f7ec76b9c9abd41baed0671d6a8b2a7eabe1cd6a0e
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZum0mJFA:KQSo7ZfFA

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2560-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0009000000012118-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2560-82-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\sRGB.pf.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgRes.dll.mui.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	8719d39764be1b7edf8fb88c4f43a900N.exe

C:\Users\Admin\AppData\Local\Temp\8719d39764be1b7edf8fb88c4f43a900N.exe
"C:\Users\Admin\AppData\Local\Temp\8719d39764be1b7edf8fb88c4f43a900N.exe"
1⤵
- Drops file in Program Files directory
PID:2560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
49KB

MD5
81a29bedcc522a79f2f03db36eb80df4

SHA1
c49dc5a8b18b973c52c8d85e22104560b6a05d00

SHA256
c916f5eb52fc0d4f7125e5e0c86bd7e23d816e70c70cf9fdb944ab6172ef8511

SHA512
84e34d7716bd9724fbd1ba5856b68d00af6de8578a99c532dec6c5593c6d156b207f1fe45e7b69f42fd3353b9c2066585757dfb0ef2f70090c191379d7c5ad8b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
f1fc49df8915faeeaa05bd26ced6cc7b

SHA1
797da56ddb46dd44eb962e6dabd980a73e00954b

SHA256
a491c01c87bd2dfcbba2504e6401a20d6315a1682596d8b47c7123e16271b394

SHA512
8ea97260d9903df99db774e5498755e354bb5cd9ae130585f697b564ec548e8de1c8a4eaf8b7a3de9844ff353650a8346fa5b94e4689a5b45df166a057159f0f

Download Submit
memory/2560-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2560-82-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads