debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
Size

67KB
MD5

f4ccc7250410e0ea9e27b95b9ebe0a30
SHA1

dfe7808206bd6579ff20449dc24e64e2ae03892e
SHA256

debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517
SHA512

ac6f992212d96d6fca995601dfbe131efb5f9db68ecf8ff5b2af176b3374d754f9ac849000e63a79ff9b4358005a997b73578bef722628da21c9c4c7abb82c38
SSDEEP

768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXC:a7ZyqaFAlsr1++PJHJXFAIuZAIuN

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4969) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000700000002328e-2.dat	UPX
behavioral2/files/0x0009000000023413-6.dat	UPX
behavioral2/memory/4508-1808-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000700000002328e-2.dat	upx
behavioral2/files/0x0009000000023413-6.dat	upx
behavioral2/memory/4508-1808-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL083.XML.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe

C:\Users\Admin\AppData\Local\Temp\debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe
"C:\Users\Admin\AppData\Local\Temp\debced1e17201aa410d4dbfb637e359cd8c84619d9fd970f4dc22fb12b9f6517.exe"
1⤵
- Drops file in Program Files directory
PID:4508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
67KB

MD5
1e1ad72e33fd14ff07920d8af949cc0e

SHA1
0b2e130a5169e1a15889571a0c43153575b53a17

SHA256
a7915a6c8e44732dcbe05c0c17bde911180b6e5d48c62b3e12960a78873ce430

SHA512
2b570583d1d60807d0d5a154b4f399eedeb19146e4df59f09ac5e5f805fd0127cf794e8ea04c84ccbf07322df9157aef266d85e27ddd4568fc3760d216caa4d5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
5d3288eaf617db390ca58b81beba3eb0

SHA1
04c1d6525a93d236a99d86e4b29b97b09a71c7d3

SHA256
afeeda4568e0b7509f8fc8cc39a0c4dd3dd6a0ef70b3265ac5cd3c96db82f907

SHA512
c843f256f68b1a586c00a93a2f3b8b8ed89faafe9ea89e288fb9d78d926ce8a5a9f424aa4f36ffc9f68d95ee82e98704787cdeff07421e60390fed2a9ed4c0f6

Download Submit
memory/4508-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4508-1808-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download