Malware Analysis Report

2024-12-07 09:57

Sample ID 241114-elsyzstlf1
Target eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2
SHA256 eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2
Tags
upx discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2

Threat Level: Likely malicious

The file eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2 was found to be: Likely malicious.

Malicious Activity Summary

upx discovery ransomware

Renames multiple (4531) files with added filename extension

Renames multiple (3454) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-14 04:02

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-14 04:02

Reported

2024-11-14 04:04

Platform

win7-20240903-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe"

Signatures

Renames multiple (3454) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre7\bin\management.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Windows Defender\MpAsDesc.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe

"C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe"

Network

N/A

Files

memory/1964-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

MD5 d69b075cce837baf8a26aa37ea7e848d
SHA1 890cd18d96e9c17b65ed99a242cdf31316fd4923
SHA256 fb1b5de3ed6fd1dafa993b26e8a72f67c5ccf6c5cc8a0e867e97f8133099948d
SHA512 70294ed3838ce26ee89a8e80fa5ebd0128f7f91c25f53610d572c88dac7272767a7971ea64345d991e3952cba7d61d630f8d5c0c2f9ad22ae62f2686d9926067

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 2c4b213e4d1b38e183047037eb33486b
SHA1 758143ebdb0bd18f0595b28697001efd292db57f
SHA256 d2bd823c21f54e06e778cf6f0c66690b00a6c311d44d0e89b4c2ffc20cb8f595
SHA512 3c12c4f59b202b12daa30451637585efe554bb9c5f6a8519342b063c30e2974120fdba38191fca4cd73e06215b5e477c67d7b6eb48c43ae1521e2853568ba118

memory/1964-63-0x0000000000400000-0x000000000040A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-14 04:02

Reported

2024-11-14 04:04

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe"

Signatures

Renames multiple (4531) files with added filename extension

ransomware

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe

"C:\Users\Admin\AppData\Local\Temp\eec679b74b7bdbd6e9fd3e921ed1d1f57d82c68e7d41d4f1b33d7822e3deb7e2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/824-0-0x0000000000400000-0x000000000040A000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

MD5 8675d2f20d2fef55eb73e91f5e4ae12d
SHA1 ab7442fed7c83e3fa46b48f9cd7cbab52896ca53
SHA256 8f3cddcf8614ca02cc71db8f93b5a0b2668154cb92be6f85c9a963ad3e2b348c
SHA512 26a339310334af0691ec393443975005680ad85cd3fbec6b37589a29be85e00a3dd6cc69a8a1e8c9236ab0eda3610bbf711f81a3e7ea907070a1ca36603799e8

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 4f3a384bf281f5f42282011f756a6e3e
SHA1 6cd111013553c9db173640131108997915b00215
SHA256 1160b56a6316a96c7770a12cc8d8f658a7528d2aa9dc6c7f9c863ae82d58292c
SHA512 515c62d0abcbf5c65d1623f75be7d76e6298518e72c6515ed21f2360e85a46002f21e141156b46ad50398ab73a23b34f61fd913928f6807221ee6ab8b5cbb811

memory/824-639-0x0000000000400000-0x000000000040A000-memory.dmp