Malware Analysis Report

2024-12-07 10:02

Sample ID 241114-dj287stepj
Target dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N
SHA256 dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4
Tags
discovery ransomware upx
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4

Threat Level: Likely malicious

The file dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware upx

Renames multiple (2843) files with added filename extension

Renames multiple (4209) files with added filename extension

UPX packed file

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 03:03

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 03:03

Reported

2024-11-14 03:05

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe"

Signatures

Renames multiple (4209) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeulm.dat.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\GroupSplit.avi.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe

"C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 101.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/3060-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

MD5 2d4b9827350e0327585b12bd6fafdbde
SHA1 289469a4b7ee29e41b4451712ff6106d873404bb
SHA256 4f9025518a92521f4192180337f19907234943ac4bcb835322370cef729da8e7
SHA512 1ab8ba3caa0d87b9d7228bce56c77c728208c71f7b4a586e783c10b7ff735983ea437c86f5d5c8d3792ebc37ac2d31f19606b1f420b2e18f02d4482adcb6c018

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 056aca0227b867f00ca441d8b0365522
SHA1 fc16c79c510b8c66b8c43c4e1b14aae34a18e266
SHA256 f78bc3991c8a5d5daa0ec7d9cc63b04cbf887c04d2519929eb8572e1548c1c76
SHA512 7aac137f53fdadaa66abf691bec39b68fd2aeb1f79cb046d9c5c578fda52902ce574acb8e73d0774b80bb446f2b19f65b8a223eb80489726fbd32c14b3aa840a

memory/3060-651-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 03:03

Reported

2024-11-14 03:05

Platform

win7-20240903-en

Max time kernel

120s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe"

Signatures

Renames multiple (2843) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Mozilla Firefox\updater.ini.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\HST.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Mozilla Firefox\libEGL.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\classlist.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-windows.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Zaporozhye.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe

"C:\Users\Admin\AppData\Local\Temp\dd7e09c1f2fc332d6d0a9dfb35216bac45d79fd906bcc2a8f4e08c221e2b21b4N.exe"

Network

N/A

Files

memory/1868-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

MD5 302e4011c001849e55942c03fd9d2f50
SHA1 b590c63b56eadfc36f3f8f8198b53eaa0e8452b8
SHA256 8531450f3badb6d2e14c3e66abe46957ae99ea3c180b74087cc2c11994d56008
SHA512 eaa1743cff7e974219962f923086173e8ace081bde6dbd49f7930bcc0dc233ce275e0786ddcaf689ad09a63cec0eb2940196a3abd8444f8b67f2c36192310fff

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 1e21260500eba0765ad0049b93cf25b5
SHA1 97908b328765806d837cdfe55d40dcb2baab34f5
SHA256 036e6cda683d02de3070d636759fd5676426d58fcf976a8c4ad21fb887741f0a
SHA512 f177196b29db54329fcce894cd99aaab296f77c40d5a3d399714c642bd8d2ef0c63ec74dac3b7c55f1f861300e804fa57951d19efd058a65959409a60d89ef8e

memory/1868-63-0x0000000000400000-0x000000000040A000-memory.dmp