72a95617026a285bbfbf581bb38339cec39f77c916db71de19301d600fbdf1cf

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
Size

22KB
MD5

4f69ee5bf6556c3f1e7fd2ef3f8d4d90
SHA1

f31bbd0450ef224e52fb31c81ca2fc8b67e417bf
SHA256

72a95617026a285bbfbf581bb38339cec39f77c916db71de19301d600fbdf1cf
SHA512

09f1f362e677a912da18bc4b4bb0007c0b34749eb8ea39ee142f6879ab5dbdfe90caa496dd338314006392cd156ba330412aa63b8dd2ce94583d8b2877d301b8
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJblDZblDZaOpeOpWB3j3cbNQj3cbNsmcacT:kBT37CPKKdJJBZBZaOAOIB3jM2jMhcaw

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2612-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0004000000017801-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2612-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\CheckpointUninstall.vssx.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe

C:\Users\Admin\AppData\Local\Temp\4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe
"C:\Users\Admin\AppData\Local\Temp\4f69ee5bf6556c3f1e7fd2ef3f8d4d90N.exe"
1⤵
- Drops file in Program Files directory
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
22KB

MD5
fcf850d5ec3ff1c0595e252efa1cd6cf

SHA1
7ae9ac0ae1a11f63422cd4031b2a692fc49704cc

SHA256
953cb6e80a170a9829984882048e6c7abeedd63800e279e02937713c05ceb1ad

SHA512
a57cb23733735bc7af144127b3798e89aec91810b920c46c4984709efadf49ec8b9b8dbdb057c947d8e9b9b95ed6381d19fba4d065dd13e791ca3bf4dd340841

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
31KB

MD5
6add282fc2cf587418c67560de45cb47

SHA1
e0c242a4a24e816289c77b9b009012a0348d8be7

SHA256
85eacd2ee82986f98dc9458e41c52521e8b1af6d88eb45c19c8ab38d50f4479e

SHA512
3888080ed82588b873b8785ae6b0858e2fee353923ac8c5f9b2cd26130ed495f387c37d8a31c9b7d3f2841d01a84cb61041262d80248d395e49c2741330ada7a

Download Submit
memory/2612-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2612-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads