0fd630cd2a3a40e5a7c91e7b40b82674fb063106fa8d312e89c6ca9b28114f94

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5727562f999db65133c8b7e376ce0d80N.exe
Size

53KB
MD5

5727562f999db65133c8b7e376ce0d80
SHA1

92dc6e7a83477ae7926dc7bde573a0144020f193
SHA256

0fd630cd2a3a40e5a7c91e7b40b82674fb063106fa8d312e89c6ca9b28114f94
SHA512

579d06b40b00c05ffbe761f6f122b7d7b40816397de4ab1f6daa8c490ab0f0938ece521d3173be1c5e13cdfabf92e53ba416a40aa219dab7df2363ca9b1e842d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcB:V7Zf/FAxTWoJJ7T4

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2136-662-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\NewPop.svgz.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ir.idl.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	5727562f999db65133c8b7e376ce0d80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	5727562f999db65133c8b7e376ce0d80N.exe

C:\Users\Admin\AppData\Local\Temp\5727562f999db65133c8b7e376ce0d80N.exe
"C:\Users\Admin\AppData\Local\Temp\5727562f999db65133c8b7e376ce0d80N.exe"
1⤵
- Drops file in Program Files directory
PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
53KB

MD5
4cab11e4ff5c45dc8705cf50c72aa90b

SHA1
435ce757b7680fa4cbf5d211ba38cba99e14f0e4

SHA256
36c78e4467c48af5cf3d6bc421b44fac697ff29f6767ce9ceb817f328962ccb9

SHA512
1072c5b27cff7de1f5bd651446eb889f73227a6f0ace0c2520663ca10e3eb9ea536351aa1fce22acf55b204d43f45a64cab77532f27474e5de022c4e4b064608

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
3a265d562b6b3d8d6ad9bb9daa858100

SHA1
87f69acbeebe7fce054bfd50e7e707be99790d28

SHA256
55102f3c339f57b7079f7f7b7d5a4ecd50eb44c9274ec2281af289ddd8378b40

SHA512
a8a6943c7c49c0bfa5d83050972e5354fda11ac69845803d186a4d737103e3ff05c9c6d1ca156df3e22cbf545b681e4486438875439924d7343e59aa8260f875

Download Submit
memory/2136-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2136-662-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads