Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 04:52
Behavioral task
behavioral1
Sample
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Resource
win10v2004-20240226-en
General
-
Target
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
-
Size
104KB
-
MD5
6f4b1cd0d7c5b5ef131cb3622ef4274e
-
SHA1
122a24579eb484babc6f72b10bdeb1d89ceaed83
-
SHA256
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a
-
SHA512
575f501a3c45e9b8c8175be43d84b69fe21654fcc1ee0ffe6f279fc05a55e260bbb3102252070248261e99c7b0c08479485466c124e2ca047b98cc68ce5e4468
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxFy5gfcL5y5gfcLdddYzpcl/DOkBruq:fnyiQSoXqeaqed0zgTCnq
Malware Config
Signatures
-
Renames multiple (3430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp UPX C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp UPX behavioral1/memory/2168-640-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
Processes:
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000040B000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2168-640-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_mmx_plugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Mail\oeimport.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Photo Viewer\ja-JP\PhotoViewer.dll.mui.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Half.png.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp dbcfd1a65e7eed119bc380fd62b017f2b2ab7f46fda83ae388dacfaef3e2a54a.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmpFilesize
104KB
MD5a4d5bc6b7b9099513767be178994f29b
SHA13826a7703601e542be135b6de1846e53b9983e44
SHA256e7ce76bb3052b410cea544899809e85d5b62ddcab3f0eb9b36607f5e6dcaf17a
SHA512d65f00f7507a6ee7fe45876093f8d5d2ea8e849799894be01166e2617011ed4d7818a67b66891bfe5976160bb12c4f6f8e5f1871dad1d61106f5a05c31aeb895
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
113KB
MD522225576437c5934aa3764c15cdd98cd
SHA160aad2a2326641acdd7b4b75e05e9aecebe0f2a6
SHA25639376c86b702635de8dc6bbc306baeb14e2ceaf17bb4c83f2363095aab071026
SHA512ea78688a2fc0753f3a73699c6a7ceaa88bfb8630afb61c2bf13d465688281227dd122e18f6931b3b50640cc38b216742176e6f4bf43ddffe375d2c9d04f25edd
-
memory/2168-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2168-640-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB