Malware Analysis Report

2025-08-05 21:56

Sample ID 241006-ltmkhaxfjl
Target 0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N
SHA256 0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356

Threat Level: Likely malicious

The file 0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (4651) files with added filename extension

Renames multiple (3214) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 09:49

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 09:49

Reported

2024-10-06 09:51

Platform

win7-20240729-en

Max time kernel

118s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe"

Signatures

Renames multiple (3214) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\7-Zip\Uninstall.exe.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\security\blacklist.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\7-Zip\Lang\mn.txt.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe

"C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe"

Network

N/A

Files

memory/2300-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

MD5 60e70bb26477a027216f812eebbd6ab3
SHA1 a967f59635ab0044a460fcf76ddf566722f205c1
SHA256 7b84c5ff6215e1ad61fd6e9494168ed2922c134fede23c5dd75baa24aed8f89c
SHA512 c9c1ad30901e1f16896793b47224cf8ebe3f9c254e485fe54c6ad50953e46ce33dec1eb6ddbdc3f87be61c86e9711f2adede0ce6d13b230c44f051f64575fba7

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 5cc183047d1fe8c1b95733a874f04f93
SHA1 827aa38a2b7d949999dcba5faa06cac11ae0db20
SHA256 a1393d60baf4b757e01719841e7426b49484a167eec6b819562bbc9047aa0937
SHA512 6f6ecf8b01f46270e17869083c140353a334a8c581c27a088f58f85b694807fed08a90a75fca50ae38665261b792d7b092744504003e7c2cd64264c18d192a3b

memory/2300-70-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 09:49

Reported

2024-10-06 09:51

Platform

win10v2004-20240802-en

Max time kernel

120s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe"

Signatures

Renames multiple (4651) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe

"C:\Users\Admin\AppData\Local\Temp\0486a588957cb7f4ecc2e8ad77ee2510ddfc6d37e12e1ab4c80e3b2d7b8c8356N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/4456-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

MD5 429a8c7f3b927b01634346c058930294
SHA1 60f538c8043670403118d47ad47aa958bad8b2ff
SHA256 6744d49006d33a79a72c6e487869c9585c363c209ec95c5d1ea6104281914710
SHA512 851daf26f935add7da39fd33b955fbde2415bd16ebae393cbf8f798f2492351d20fd2337237686202f4e4ad67b1ba7cdeb540264d16a1e68d1cd582c3ae08bfe

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9d25208cf8217b8758ac6064d690298c
SHA1 1152a44ad4dd4afc4629d451c6ef73aa28853840
SHA256 b0afa56ab2103146fc183214a45201ee90633969a3dcca13a448f2c003290939
SHA512 0cf4b88e1e51483ba739fb4db36b51c34daf2852ca309e7248644e9308f4a8f01438d162bc10da5a2a4382d63c420321d596b2749ed98c861ac4aaad50a93c4a

memory/4456-878-0x0000000000400000-0x000000000040B000-memory.dmp