c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
Size

96KB
MD5

a09d9f23d7cf097cad5a88e8b35af246
SHA1

0cb8abbbe2dcea79d915918be3755c1d2581fc77
SHA256

c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499
SHA512

33a286d0442ee1f0c970b71a784de0f371d2755de7fe6b815be7bf5b22c17316f05254d2e95863938ab72c85454b75e4e360962c306e043caff226d36e4570e1
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfO:hfAIuZAIuYSMjoqtMHfhfO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3442) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1752-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000c00000001313a-2.dat	UPX
behavioral1/files/0x000200000001048b-6.dat	UPX
behavioral1/memory/1752-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1752-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001313a-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/1752-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\cpu.css.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\settings.css.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.log.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\weather.css.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Journal\es-ES\Journal.exe.mui.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Defender\MsMpLics.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe

C:\Users\Admin\AppData\Local\Temp\c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe
"C:\Users\Admin\AppData\Local\Temp\c2de9d8bbcbc77eb9aa64aee8f3de6e8f3db5d7c51c8de0e0f9fdee082218499.exe"
1⤵
- Drops file in Program Files directory
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
96KB

MD5
6507f488fd4fbce76b235aa9ff97c9f0

SHA1
4e9fa539a0fa9b0c1c86957a039b7bad8328e006

SHA256
b1d211598a244a4707afffc5ed89397672fc36cd56b67a83ac30a84291faed4e

SHA512
1f297a7d9d1453dc06c5ee8e97c3b36c2f6c1ce9435a74bc58d15ae8fc1f7f485ea095315ae11df71ef59af1074722d0c10ceaa1adc6be059fcb71851b490135

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
105KB

MD5
c93aa6e25419aea169bae3548ffbc0d8

SHA1
17cef3c1ff3e4db40a292bb674944794236128b7

SHA256
4bfa3c46b9e6492049e21722be0926beef9497c1140040bca2c2b4e24841bbf6

SHA512
4949bacee16562b174a34b1bd0156b192efd506547dab73c2c96f504afc5c70577a83af529b0d445fe37922d2d8eb16d9ab195126377565ee3f2d2305dab80f2

Download Submit
memory/1752-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1752-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download