474003169c5b6033ceba8af799d62d2482682ed7f4d45066c04524a5f5b8eec8

Analysis

max time kernel
118s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d49ab9562542f9b962850e90ae89a080N.exe
Size

52KB
MD5

d49ab9562542f9b962850e90ae89a080
SHA1

4e89aec7eaa316e1458df84a917bea99f3a4f8b0
SHA256

474003169c5b6033ceba8af799d62d2482682ed7f4d45066c04524a5f5b8eec8
SHA512

febd82d2cbef40067fe373be6fd3fe876c9937505d001e32af70451f2e1f1dcbad174f011fadf956df2b2e9012259c3c7e3a0eabf2e0471fb149bc076a141173
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIe:CTWn1++PJHJXA/OsIZfzc3/Q8IZv2n

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2822) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000e000000012267-2.dat	upx
behavioral1/files/0x0002000000010667-6.dat	upx
behavioral1/memory/3048-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\jce.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\ChkrRes.dll.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	d49ab9562542f9b962850e90ae89a080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	d49ab9562542f9b962850e90ae89a080N.exe

C:\Users\Admin\AppData\Local\Temp\d49ab9562542f9b962850e90ae89a080N.exe
"C:\Users\Admin\AppData\Local\Temp\d49ab9562542f9b962850e90ae89a080N.exe"
1⤵
- Drops file in Program Files directory
PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2660163958-4080398480-1122754539-1000\desktop.ini.tmp

Filesize
53KB

MD5
c7da85ac0fc155621b1edd29f6a9f1c6

SHA1
a89b41100591c6b09deb572256080db958802b8b

SHA256
af0be3b5fa861e9525e1e76e91757048c8f13400e10cf7db182d6155b29d4081

SHA512
10051ae641e295edcaa677771f680f0a842b33c72abc3534de7c08b61056aa07a0e63fb7f0f3c79d7a9c89bc6fe41deb471fe786fae8e5f5595f27a6dfabdc00

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
c87b72efccc979f714d24f3f60871f3e

SHA1
749386b544b65a0ff7474226c38bc4eea09171f3

SHA256
5e024ac6a7f937e9795b8a6ef0996cfe3f227644bb85be8b89b8af63aa04179b

SHA512
227ae5bb07d7f31d544ea12ca2827395986e412c021db8f281d47d8cb3c1730753e2be0ecd25676f3a179405476a9b2e040a1c0881ac442c2873057062a77222

Download Submit
memory/3048-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3048-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads