dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
Size

64KB
MD5

751e930f6ea033110e325444411dc25d
SHA1

8b696b47abfe409fed124f1e7e8c5a0621a59548
SHA256

dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98
SHA512

06c9ec755f6c234fcacf77339c2ee297b565d6868e3f47541aff6e4444c3a3da884de613f55e9af83978e2402562a3cd2e2d4070d9d0e64da8dd4f23d355a1c2
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFZhfX58/:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5N

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3686) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d00000001232e-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2880-658-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\gadget.xml.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\localizedStrings.js.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe

C:\Users\Admin\AppData\Local\Temp\dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe
"C:\Users\Admin\AppData\Local\Temp\dec114b70621dad94f36d0c3aa613a54e68fbcd756625ac1b3c8c962bc8e4e98.exe"
1⤵
- Drops file in Program Files directory
PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
65KB

MD5
baebe15dc542dc8e7069708fc67f8a50

SHA1
287d694779d5f703eb4d30013d41ddc10e305621

SHA256
a3aeb1aed6fbd4389fb647e8e6af584b364ef864915c0d32ddaf74a800751f3a

SHA512
eb44a7f086863ecec29754cd593c8a927e68e49d957ca2f96b6bb49ceb4852eee95aa97ea1a0a6374e8a1ab2c3805ebe14d76cb58d40f44cbcc1a51a135e42a4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
35feab077ce8a47824177b77c3a180fd

SHA1
eea9d875caaaa9c2e9d5a7fd9643045fe24974cc

SHA256
d611554704e54508b4f2a5499b11597b3c09b74e5d8e486bbe67d00a5c2cc681

SHA512
598f60dabccc1af3c53cc28da66dcd0d98ca747d137e491225f53592c88aa694f2fea3d81b4474f9db240191e0af64195854aa65324580abe0058eea09e17e69

Download Submit
memory/2880-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2880-658-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads