6888f77c87e163210c8497a2535fc28474d8d2d3056f41bbf6753c92196e36bf

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 05:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6ccb5ac08e52ada2e8265913bea73140N.exe
Size

50KB
MD5

6ccb5ac08e52ada2e8265913bea73140
SHA1

d50dc9491a73c3ae1d24be0778225ba780ea1d5c
SHA256

6888f77c87e163210c8497a2535fc28474d8d2d3056f41bbf6753c92196e36bf
SHA512

88cfabfc919789e00f19a3fd75d41cfc378181737ee4da656ae2782e28bb14e542d8f87adaf46b6c3eb98eec3139116be0a396b880d3dbda13dbebf64cd73d78
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyK:V7Zf/FAxTWoJJZENTNyK

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3064) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/1940-646-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	6ccb5ac08e52ada2e8265913bea73140N.exe

C:\Users\Admin\AppData\Local\Temp\6ccb5ac08e52ada2e8265913bea73140N.exe
"C:\Users\Admin\AppData\Local\Temp\6ccb5ac08e52ada2e8265913bea73140N.exe"
1⤵
- Drops file in Program Files directory
PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
51KB

MD5
fd5cfc33a26a1ae6bcd348bb49c0c509

SHA1
901722836c1e7f5e2b4479063746d44008ff0e6e

SHA256
99b1b4425a5b8117ff8eb63d5e8301856de4563f222957365ae26fd0f134845a

SHA512
da2a40709adc0d0f9f6a8aa7aca911fe713856aca77d7143b84b514f83575a484476d6e2acb197c75f6a1bb06c2c3b4fb55a97adfb322d2568550fe4d83abd9a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
1e2be616d72847dd10f87fafd8221af8

SHA1
f71690db41be6ffddae98c36b436636df8aac573

SHA256
e50da3e174f6c8fbae92dd85e2d4507c30a073689a077235c1478047f3a3f2bd

SHA512
885cbe3c5d90fbd7966d20b6f70644df3d33ddfa945e5f06030399d95483e345fba3a491fa783a371a4421b2d0f51e76c8c0110b627fc9d51805ec42b1f58b46

Download Submit
memory/1940-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1940-646-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads