cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
Size

50KB
MD5

479dbf6afa8e08f8c1361693c1c7836a
SHA1

c4607cbaffba2aa78c44ceedb1dfbf2618e9fd8a
SHA256

cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51
SHA512

ea9f39494316ff9ee289c0f9e0cc6be9d10354efbb570460ef536e07edf13ba7b862254885955407468973dd76cf574e604acb77c0c28489744b97c925c08beb
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUs6iYid:KQSohsUs6iYid

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3505) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000c0000000167ef-2.dat	UPX
behavioral1/files/0x00020000000106dd-6.dat	UPX
behavioral1/memory/1936-68-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c0000000167ef-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/1936-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Journal\ja-JP\JNTFiltr.dll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Resources.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\WriteUninstall.svgz.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\weather.js.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\bin\javaw.exe.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\clock.css.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\VideoLAN Website.url.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe

C:\Users\Admin\AppData\Local\Temp\cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe
"C:\Users\Admin\AppData\Local\Temp\cd22ba7b10df8e85062a4e8df18d345048e30ba3e9fe8b700fd1ae096a45ab51.exe"
1⤵
- Drops file in Program Files directory
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
51KB

MD5
947601a284f2b4cd564d94e3075bc135

SHA1
fc356df12b5e99cc3aaa153170e43dd73f11e416

SHA256
e52eb77532973bd9a647760c0d4fac2df9f04db7d2dd86c1b84affd564a56e08

SHA512
650c946e854d8bbb9de267cc3c2bf933e10e3789b34758bc511a982d69074f94521e6a411b2ec517c6db5f4c6491874617cc0aaa919e3c4eed18269e212d2446

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
123dd4cd3c9a578ece0f0120aae3b53f

SHA1
336ff27965d10f068f018821064d808e16df106e

SHA256
24b12e6f2600f9bba3303349caf6d5ce93edc9e8c9907f4d3da818fd2a960811

SHA512
ec48a355ca6d7c13b4fb43e07b5468107acf803317a49fc8d4dee495730287f726f10bfb7e8a9b8b9899745ac3bdd3c4530ac799e8acfe1007307d532e2ef0ea

Download Submit
memory/1936-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1936-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download