3b71ef6705ed8420bb4dedad2e6a9e51274b67ebf97da0bc722fce60173181b1

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26416915653d3caa80a9d4be853ef5c0N.exe
Size

24KB
MD5

26416915653d3caa80a9d4be853ef5c0
SHA1

721ea99ab331679b327b4d1bef24232c0126e1d9
SHA256

3b71ef6705ed8420bb4dedad2e6a9e51274b67ebf97da0bc722fce60173181b1
SHA512

da6d3418830021a200bbbe703aedc81e5550aaa1e39865c8a37dd86b87b92d39f26e9dabc391267e5948d68f00f6b279b9d8aa653913e6884dd670334072ecaa
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJXGiSk7Tkiy6tuy6tu:kBT37CPKKdJJXGiv

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fd-1.dat	upx
behavioral1/memory/2768-3-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0002000000010663-6.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_read_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\HideOpen.csv.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	26416915653d3caa80a9d4be853ef5c0N.exe

C:\Users\Admin\AppData\Local\Temp\26416915653d3caa80a9d4be853ef5c0N.exe
"C:\Users\Admin\AppData\Local\Temp\26416915653d3caa80a9d4be853ef5c0N.exe"
1⤵
- Drops file in Program Files directory
PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
24KB

MD5
5b1fc2e79e220f2a9e3a8636913dfe26

SHA1
c185e63b36af46e9ac3763673c6322514a9b6968

SHA256
f672611d2f9a60b5dc7d737a4871814c516158ed6a40e2b47864c4bc9564cbaf

SHA512
a14b3c2b498b40354b8672da35a93e53f5296ad2a6d69a836766e4f876ca0f10441d4d2d0fa96164de15b06078eac97365d246522a99219821e8777bd54a1176

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
33KB

MD5
c441e31de3c16d933fa27d0c5b299198

SHA1
fa97ef0b7a123729d9709fcc7f2ddb4b2e21556e

SHA256
fe5c8ed50e2594f7477e9b3a78303c28b8a69f0c284f062f76dbe74d1ad70249

SHA512
04c948e7b689c39b1d6137a7d984f0303314754e3e7b4a34a2a859cb4496bf12fa1dd26d3e8704325e1bd13d7c6d3bb77c12fcf7828b35bdfbcd528d13040328

Download Submit
memory/2768-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads