814e1db61095aad6cc50cdb49da11ba313e149b025dd5f6e848204c90f587f99

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

05461e802d789d718eae9430394758c0N.exe
Size

91KB
MD5

05461e802d789d718eae9430394758c0
SHA1

362775e41150db246c26ce5695aa809720153625
SHA256

814e1db61095aad6cc50cdb49da11ba313e149b025dd5f6e848204c90f587f99
SHA512

51e7dc4f1c85f02ab8d93f74626eca9b714a01fbdceadaaab9698c8d20206a87bb7217542e64104fb7806a076b5b07e0e1110456ee0ab65530dfba259b9d9d97
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqKyHP7:+nymCAIuZAIuYSMjoe

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (334) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0004000000017801-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2328-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	05461e802d789d718eae9430394758c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	05461e802d789d718eae9430394758c0N.exe

C:\Users\Admin\AppData\Local\Temp\05461e802d789d718eae9430394758c0N.exe
"C:\Users\Admin\AppData\Local\Temp\05461e802d789d718eae9430394758c0N.exe"
1⤵
- Drops file in Program Files directory
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
91KB

MD5
46bbaa42c0edd26cf32d381ef3d8a110

SHA1
7401c3f42e4d200187622a5b88c1d760e9cf6a61

SHA256
0e8ad908e469550d17eba392f82de4866e3b9ec612bf56d59147391d6a5c9bc9

SHA512
daab992a279ba17d4556cc6e0750dc436f832106f636e27c94c6676a04bc323f81f86460633e5d720daa10c35cfa5e2522eee5d2ca5c51353bb3c62e0da92e75

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
46df8381dfa88d1c25da68cdc73feb1a

SHA1
4cfe76daecc82e2338db5c8d5a0a588adb00463a

SHA256
f187826cda7bb2816d16c0890aa87f0149f13b76b48815db12f3533450ce3be3

SHA512
af6aad7594efa779bbe52dce514f1a7e44b3be8d58488d52920612007fa32dc37483039d0158bb6d3be4b2995633c00b83b08551aca84a1736c757070aa78643

Download Submit
memory/2328-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2328-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads