af401ccff2611e500ca170cb4b6c196a6dbe3be46e7e3bb8379aeb6d40605bb8

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eacfdf72d1b76d56150ac5ac70175e0N.exe
Size

57KB
MD5

3eacfdf72d1b76d56150ac5ac70175e0
SHA1

c298493407bc9bf659344ba47d8baa6df0327b40
SHA256

af401ccff2611e500ca170cb4b6c196a6dbe3be46e7e3bb8379aeb6d40605bb8
SHA512

9b2e08a5b9de856601b86ceaa1d5e956d740e3afacecfeaca3b579f695f54bac37574f0d706728804553351b017ac6df2bfb1de0d4dabd6c203d8377f51e9bb8
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIS:CTWn1++PJHJXA/OsIZfzc3/Q8IZf2Xcu

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d000000016d07-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2376-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	3eacfdf72d1b76d56150ac5ac70175e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3eacfdf72d1b76d56150ac5ac70175e0N.exe

C:\Users\Admin\AppData\Local\Temp\3eacfdf72d1b76d56150ac5ac70175e0N.exe
"C:\Users\Admin\AppData\Local\Temp\3eacfdf72d1b76d56150ac5ac70175e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
58KB

MD5
1acdeaeccfb59ac067fa10491c47b93b

SHA1
b79012c26ccfa724828af396c92fd2d615b8e0a5

SHA256
2c6cd250d6c5b3427587b6fd4bd4cb0a16129464ecb860d7864d76597bd00290

SHA512
8cfe516dcd682ce063960e53d2381beee77cb6e2ce428aeef4d0a1567ae7ff598f407cd9a527551700b00253dd498906915de4d2dae386e4c9fe91b6c5bbeeba

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
d987e4ed1dfaf40a93ed4efbea95ee1b

SHA1
787a3993dacaf7529a6fcb9ee8928209e6a6c0b9

SHA256
48758c4785fe8eb759ba0515f2fa9eb93a3562cf2142099b8f7f02d82f7eb408

SHA512
59f8c45ce5e1402dadfbce623888ca423f5406d865ff9eb39fff05b947174f4b148c38b2d82b3412eef245a162647eb2903c51051d8e76ac9cb95934d51798a3

Download Submit
memory/2376-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2376-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download