dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
Size

66KB
MD5

c0a4988eeaf440aee021d3ace3084a0b
SHA1

091bdb0b784bd8de981b8b00c312338b57be759d
SHA256

dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de
SHA512

b622297cf7532f53b3b9e750598068b91f90540e1c510ed98087f9535946fd73b8c37b06d34762c2153af9f894c3579a9693739a7ed77c338859765bed5db612
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzc:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5KwB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3797) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1164-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012243-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/1164-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\UninstallUnregister.rtf.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPSideShowGadget.exe.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\timeZones.js.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\picturePuzzle.js.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe

C:\Users\Admin\AppData\Local\Temp\dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe
"C:\Users\Admin\AppData\Local\Temp\dcceab005eeb8d398381dc6a7c1737b16fc195a60fe7410f075bb73473fbb4de.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
66KB

MD5
fa32f834d829c1657798fa54f09acd4f

SHA1
72d36ac4321e7ab623b03611fdeec7c1f5617928

SHA256
fe4531e2205457404b5dd6fc04bfae137a7c33ea77d2fec5dc6b6d0f9d98cf49

SHA512
1c2d50e6bcad251933bfc635e4a12f45802b8fbc160fc32d68d2169dd855dc1566d59cf5cf5df4dd9072147c5e4c54c208ad07c70e06ec1de0adedc4ff724d8b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
75KB

MD5
51477a63444fb66c2716a8051f9c5d37

SHA1
0e36bbab5f75c16d7e6ecb644fd627f348d6b475

SHA256
5e315ab009f9ece9ba61ef5bb767331fe273c1b569d4dc7f6dd63f53d81930ac

SHA512
6412184773f8c7fae8c10602b9493e41c04844a3c72ae98889b6a9dee74dc4dbcb874c9ee59d8e3c1b06b39dac0ce403180445e2873f9e0695aa6623cc3025ed

Download Submit
memory/1164-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1164-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download