c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
Size

114KB
MD5

852604a0939680c848bc3543943882d0
SHA1

0e1272e9166c26f2a88e5862b4712fc172cdc6df
SHA256

c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465
SHA512

0f714b35970ea27efca552dad783219631fe6e0e1af652bd1461cb54cb9295f94e30f87c03dd3a401f711c0ffd219ed74b88a51a0be4421c60d168cec35b217c
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0xd:hfAIuZAIuYSMjoqtMHfhfE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3454) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/992-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000c000000012279-2.dat	UPX
behavioral1/files/0x000200000001048e-6.dat	UPX
behavioral1/memory/992-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/992-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012279-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/992-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\wmprph.exe.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Windows Media Player\WMPDMC.exe.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe

C:\Users\Admin\AppData\Local\Temp\c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe
"C:\Users\Admin\AppData\Local\Temp\c5c66792b98560f854ce274b7e97eb651ca0445c81f8a0da8f3c6b6482dc5465.exe"
1⤵
- Drops file in Program Files directory
PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
114KB

MD5
ffae3d3da4d4debcc52d2da026e508a6

SHA1
884d60fd1d78ee351c0c4b178ab5b34578078b12

SHA256
6049203766f4a98e1770f582494fe774f4724ab00028c21af2dc2a62b3fcbe00

SHA512
727903cbfd59e70d82d8baea7e00c6ecd5b9aeff8c33e27b1e69eb00f7883198d345c00c6e44b2ec2ec24d476566a34921a13ac238161a01f7e0801c35f6387c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
123KB

MD5
9333e77e02083b9af4817088a0ac81a0

SHA1
d90f5248ca9a3e4818323dda49ae98ed1d811508

SHA256
1aa9c573389662ac00ee4199ef420b89048cb315443a35649112ea83927a92de

SHA512
4e0af489665695b13e9e07f9e42e0b1d152b58491b1d0952bb7364ff8dcc06fc18f8405dd5de4b5d49faf7dec4d778be253d5612775ec5981a1d49d1ce6bbcf1

Download Submit
memory/992-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/992-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download