cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 03:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
Size

111KB
MD5

38b3a669dd4531673667b4d8e9e5f335
SHA1

c8f0aefc0400d6b13d02497f1570e0d984d6d396
SHA256

cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163
SHA512

52133aa0ee1883fbfe276f5d16c57ae98332b6a93638f43245e871edf9e7a14bd2fb7972c9ab1aa6ea2f6e7c1c69f417f5372a4016fae13993aa35fb5e0f24b5
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q85qgnDfdPux8I20AoGjv:fnyiQSoCqgnDF2vIr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3053) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b00000001227d-2.dat	UPX
behavioral1/files/0x00020000000104aa-6.dat	UPX
behavioral1/memory/2988-162-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b00000001227d-2.dat	upx
behavioral1/files/0x00020000000104aa-6.dat	upx
behavioral1/memory/2988-162-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_ja.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk16\windows-amd64\profilerinterface.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe

C:\Users\Admin\AppData\Local\Temp\cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe
"C:\Users\Admin\AppData\Local\Temp\cdeda24baa3567f16e9133cb89d9d057574bd67c236b193971a5364daeb49163.exe"
1⤵
- Drops file in Program Files directory
PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
111KB

MD5
d4927d8e387994e584311dede0b6216c

SHA1
83ffb138e53d381d2be4c3c37c70da690657c80c

SHA256
de3d90070ee5da325dcddd5524a4f656e06e51cee1ce8bc12d9a728dbe2646e0

SHA512
6b1282e269e9d986fcf60e694ec0eb3e0078a4cd1c3b1a89b57d895c6879ce67d964da1165f5aaf203b544cf0bc5dd5e57c22547d0032857a76c7bc483f9de2a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
120KB

MD5
5f38eea3106236da71b54fffdfaaf0bb

SHA1
658e042d7c6f9f8a9b2a129c6246adf5ec184ef2

SHA256
b006d01f1421f7f4025b86a4a483f72cb4888c057b2bd6f95f4413f5d4740712

SHA512
01d4bd1afcf0898ac9b7caa1e07378154c20d50bed4b5018681eb9bad97cfee676ffe8c3e7362438796313a901bff19f97052dc551dcfec57de541ad52a87b1f

Download Submit
memory/2988-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2988-162-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download