809f2b657cfbdff36e072057224d998790abdfe0aea28d11af7c9a78045351ed

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 22:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2068111db8e1884bc853d1d1da87fee0N.exe
Size

73KB
MD5

2068111db8e1884bc853d1d1da87fee0
SHA1

a2e4132e78147c36dbe99bbb6c7d7d842d214747
SHA256

809f2b657cfbdff36e072057224d998790abdfe0aea28d11af7c9a78045351ed
SHA512

d2be640e7aedbf5e3c6ee4528e50de0550a9f6330adad6a268c3b717efb2d2c90e658e6b13dd031a97db62edf3c9331acb795317dc92d2789ce529227089c9ba
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZuNEC/:fnyiQSo7ZuNEC/

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2948) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120f9-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/2368-638-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Regina.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	2068111db8e1884bc853d1d1da87fee0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	2068111db8e1884bc853d1d1da87fee0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2068111db8e1884bc853d1d1da87fee0N.exe

C:\Users\Admin\AppData\Local\Temp\2068111db8e1884bc853d1d1da87fee0N.exe
"C:\Users\Admin\AppData\Local\Temp\2068111db8e1884bc853d1d1da87fee0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
74KB

MD5
f36821bd48ecc7b2a197ac80c0f5dc2b

SHA1
a356a1f5819fda03e654b9061fcab462e7d70c60

SHA256
7efc8e585259891c9d743bd90ad60c2ea525e74e87594bdc9a1aa91e55293470

SHA512
ca2d34134cb8ea5cbe927d2dc1fbcbd0fdc4ffd970500611ae157268930fece5788ab957caaddb704d7909444143359f4db90b80140509ff9406e3c4d3cf1b03

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
d35a9b665cf1d44167dc85001e19a227

SHA1
23b03be7894a8ca4d6f0098b002489f1cd45ba92

SHA256
37ecce4ce16f46e5969de59cfbaa7d7812fe95e1b2086a2a2449f613be601696

SHA512
6fafb69e54f97e56717469f3072bc55aa04b67cf6a0f0ac6a28fc34434c551804741cc314aa3948c82df257357b3ccdb525ce7ada69e0c39b3ef63405ba87d4e

Download Submit
memory/2368-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2368-638-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download