5abbb051419b4ab1b987b004f34b834da065267699b7b3c69c2a15c83c37023b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a191ea807515079c5aa9426c80578080N.exe
Size

22KB
MD5

a191ea807515079c5aa9426c80578080
SHA1

d9e5a5bc8334c7ee891f9c47d072d64de7dc5a98
SHA256

5abbb051419b4ab1b987b004f34b834da065267699b7b3c69c2a15c83c37023b
SHA512

b9240e239541c21a9625051292d3e2feff73550a2e04720bdbf8ba06f8621a8d821b524b7ae78e32e65a6588153c5068bd52dc68e700991f03cf35336917fa4e
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJblDZblDZaOpeOpWB3j3cbNQj3cbN3EFEA:kBT37CPKKdJJBZBZaOAOIB3jM2jMa

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (495) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1628-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0009000000016c1f-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/1628-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	a191ea807515079c5aa9426c80578080N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	a191ea807515079c5aa9426c80578080N.exe

C:\Users\Admin\AppData\Local\Temp\a191ea807515079c5aa9426c80578080N.exe
"C:\Users\Admin\AppData\Local\Temp\a191ea807515079c5aa9426c80578080N.exe"
1⤵
- Drops file in Program Files directory
PID:1628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
22KB

MD5
b009ab7661b8dde3b0052ec48fed2263

SHA1
3033ac81451fb43c2a4b7c0ae24d90b5488425e2

SHA256
c5451e13266806ff9cdb6450a2cba22dbbd7af3a15e53f9578fe12db4f41f1d1

SHA512
e7a585a93342641b57c7bd15ebf30bad53598bcb24a1bdfe695f1ce59d251d732199122f01284d59ad0f5e956d67dfadf5195e8648768ce3b87c51b81283b01e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
31KB

MD5
6fcc89db0abd8f0a38b2eba9b6c11e9b

SHA1
4e74fef96781b344f1cf8cd4cdd4febeb31c357b

SHA256
e140854cf1c492dadfd60602b401b9b6ef1f7c667d843f789fa6eba5cdc24a73

SHA512
e31e17ed9c1ab946ac01741f1bae05b5fb3a73d9561bb599485b73f909feea74fe3336a6829378227f653b48bd712998351f922360c6e42950c0c53a1f15728a

Download Submit
memory/1628-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1628-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads