2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
Size

66KB
MD5

6e53ef5de94da16f8b676b1b52c3498a
SHA1

4247c0801fd64cd08bc2d841558934b69700478d
SHA256

2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a
SHA512

6ddee2349594ef2f304a5bab4f95baf0bbab75b7471299f7abb35e8e42b468512953a438a126790b774a00bf0a19c2e77dd51def293bb37843812ee1f0d4360e
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZf2XcxUykUyl:KQSo7Zf2XRki

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1676-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0009000000012286-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/1676-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Media Player\wmpnssci.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_up.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsatip_plugin.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe

C:\Users\Admin\AppData\Local\Temp\2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe
"C:\Users\Admin\AppData\Local\Temp\2a0971cc7020f2b839b37b82197d0f0a0d856504becc77c36f1e10a7fb9e514a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
66KB

MD5
b11872ce95e21f0a330d834169231fe9

SHA1
151d168728b40b776dc9488db4c2ee017ae95c7f

SHA256
e3e8fb3fe0856857c6d06d62921c5ab7351839da297cd7412e7dcc135063e018

SHA512
7071121789e177e15bae17313fd37f26cb0813ac7752beb9169b202d25b0efbd07c5ad1574ed7d742cf38ce9a6b03f6112f57f7f425e81c138ebb8807c2ec944

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
75KB

MD5
aa1835d05d5f20eee6a7d357ef0598e9

SHA1
754316daf388a63355e5c5b40dff091d0736b4ee

SHA256
57a72643387dccf870494b54ca645d7391e1bb1d657feda80eea7c315951955f

SHA512
b017d073fb6d1c3de4209e64f81b0c3462b0147b3a971f0d08c1e739b539419038e3407809bb4f0f8f33011acbb7d1845fd5b007c5def9d78f4f857c9b426fdc

Download Submit
memory/1676-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download