4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
Size

170KB
MD5

e7466b9fa46170d20050bbbfa3e73dab
SHA1

625751b8f34a8f6694ce62bb6c95eb4c600fa5fe
SHA256

4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd
SHA512

9ffb9b2deb29cbca26b40dc95d88d863da2e8c9431069b60a7552b2f4216bba317bfa79ddf003f8664f7383ff1b36f87e0ca24892a0279068639d1e0a7bfac92
SSDEEP

3072:fnyiQSo1EZGtKgZGtK/PgtU1wAIuZAIucSarSaF:KiQSo1EZGtKgZGtK/CAIuZAIucSarSaF

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000a00000001431c-2.dat	UPX
behavioral1/files/0x00030000000104b4-6.dat	UPX
behavioral1/memory/2404-640-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001431c-2.dat	upx
behavioral1/files/0x00030000000104b4-6.dat	upx
behavioral1/memory/2404-640-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Mozilla Firefox\notificationserver.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe

C:\Users\Admin\AppData\Local\Temp\4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe
"C:\Users\Admin\AppData\Local\Temp\4cc85d19d8fcd37373ad75e670b7d5380438b71692813739f8aa8c7b810d0cbd.exe"
1⤵
- Drops file in Program Files directory
PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
170KB

MD5
a2dbead60bfe19fa8eeef44dd6f2dba7

SHA1
04c374c0b3c40f602b12e6c687f777c81fa6ca68

SHA256
1690604672674f3e0a0bcc7e3f6540b86b8d102b8f21287d51230b33ced7c8f2

SHA512
8e3ba05aa5bc466f5102ebdf73fcbcc1a57cfe11581c82f3fcfe5d9a3ee622a7dd4e5aac3249c1d528280ddd89d1e824ae04fc26ff9e459917c2a399d3fffb5f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
179KB

MD5
62547447e27ebf65b027bc6ed5d0307b

SHA1
3c8fab0c71f81c94a4a915e145853bfec0c6402f

SHA256
8077932b8ad0b2439a4a25f11e7f2054d92cf4985045da592de5ccbbb31af920

SHA512
4033764dc721c7022eec9adbc8de1172cae72194fe9f4a799f2344d3b02848c26d076fe02a469c8be42306417bfef86863ce40bba1d58e9935444a0f026084a4

Download Submit
memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2404-640-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download