5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
Size

509KB
MD5

6e29f3dbff84ffa89a915b1d25cc4a54
SHA1

e236add846cb598ab8f373c2fb94c582bb7e924f
SHA256

5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33
SHA512

ca8973d2b56a792f3ba915700c8bdec2dc724cba254fab4c9c2ba6888ee3d3a3a97d81da4ac77adc78aa365aa8b246aa5963ceca8421e76ea672d8fc3cc4da0f
SSDEEP

12288:rIZGNXkbvLbIZGNXkbvLis89iMGsSaOyi/DIZGNXkbvLQ:rIZaXkbv/IZaXkbvWs89iMGsSaOyQIZg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1540) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2708-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a0000000120d6-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2708-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\ConvertFromWatch.mpeg.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe

C:\Users\Admin\AppData\Local\Temp\5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
"C:\Users\Admin\AppData\Local\Temp\5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
509KB

MD5
1dc0efd19466b579f433fe65ae512a2a

SHA1
f934d57cbe241a0564cbea32bb87363402cfb4fd

SHA256
665e0dee35285c7d5b2b56c76c0202b8f4629aa083b3de54ad376954c4df5d74

SHA512
60ca042f5d4336228094f603ba875c8693f216fb73ed072150b48e871163effd3e4e6ab16d3a55289bfd6c21aee95423a1ac2047289f3f2d33e37e9026abf4f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
518KB

MD5
bf724170e0dc56eff91ac83b6c31fe33

SHA1
bcc512f74a8cf63a4f266271a90d1eeed1b71e05

SHA256
1040064432cfeddd334e05c092b8b3933bd5d6782482475ed7987698bb7847a5

SHA512
9d08298d826db8b7f1022def2ce63162ca4c2ed728398dccdff949347377628ef141f8a94e40a7c537834c3685f46831b3ce8a3850c881cfff175bdab8a825a0

Download Submit
memory/2708-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2708-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download