d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
Size

72KB
MD5

316c490e6fe6ab493b6398c50cdde555
SHA1

72447f4ac07e51625fad397ddc6da4b0f74bfec8
SHA256

d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27
SHA512

6966610e89de9a785d3d91f258f18bf14b697cfc2d8e214041c1b0bca4e88d6f854ef8b16aac8a20105984a3c7f2a33b36880726ebeaa3a00e11ff1a5090e6e1
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJJ+T:+nyiQSo2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3709) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/3016-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000f00000001227e-2.dat	UPX
behavioral1/files/0x00020000000104aa-6.dat	UPX
behavioral1/memory/3016-648-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3016-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000f00000001227e-2.dat	upx
behavioral1/files/0x00020000000104aa-6.dat	upx
behavioral1/memory/3016-648-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\OutGet.mpeg2.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpostproc_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe

C:\Users\Admin\AppData\Local\Temp\d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe
"C:\Users\Admin\AppData\Local\Temp\d17daa2ebe1ec584e79de48e03402cdeaabd9d3b00c65664ba516ea4dde36d27.exe"
1⤵
- Drops file in Program Files directory
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
72KB

MD5
817bec05f21b3a197a8e5ce6be9b3bb6

SHA1
95a236c81a530d52eeee35e348b9f89eb07c66fd

SHA256
0c72be79cae8912679721d1156408433f385fac5fe6176b4112dce5f61b62249

SHA512
c315b4a165529d7a16e6ab221f65e1b0d089d2ddf0ede0e151ea59a2bb8e7df9ea953d2a88adb4c85ad4fb7c5135b4672d840bf4051197e9b4756a04aa38d56e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
789bf0dfb0131a56d1e3d751d8c6eae3

SHA1
07048e823f658d0f4856889dff341dc401a6894f

SHA256
53425e74f8eaafabf86337dff0fe0b17bcb7585a20d02d9753eddcc5b6540775

SHA512
17b2a482589a37db384bc81e9ed60f421ebe21d6ea0790848782429ed40fbe86bbbcea112b7d44e21e15e69663bf3bce0ca0b1e478bd39594ee6ecb3f1424821

Download Submit
memory/3016-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3016-648-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download