76148e45f0715a6846a31c5e63284255e7a12667f3a998dafce77525e7808a6c

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1d1df7e76e7beaf944fbc5c77b58250N.exe
Size

87KB
MD5

d1d1df7e76e7beaf944fbc5c77b58250
SHA1

92c852b0c5b039c87f27abf78b996977a506cefb
SHA256

76148e45f0715a6846a31c5e63284255e7a12667f3a998dafce77525e7808a6c
SHA512

bf0a45a2684ab6d4349e33920233db2e2cfa8069ea82c40318505f2edfb8c3e4664e0a1f48405cfa2e23b18d3ae8c1fc8bad49fc9efb74ba5b1a9d6f69923876
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8X:fnyiQSop8i8X

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2836) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000120fa-2.dat	upx
behavioral1/memory/1712-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1712-184-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Sakhalin.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1d1df7e76e7beaf944fbc5c77b58250N.exe

C:\Users\Admin\AppData\Local\Temp\d1d1df7e76e7beaf944fbc5c77b58250N.exe
"C:\Users\Admin\AppData\Local\Temp\d1d1df7e76e7beaf944fbc5c77b58250N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
87KB

MD5
dcb4f2f31bc3a48f55293c6cf016865a

SHA1
5b35223a76ef23604f9ef0b7700ffffb7eebeb2e

SHA256
6d9bd0f2d1367c030137fef7a28a8d21b1827afd8ec40d9348272a75001f24fa

SHA512
0eff8125b7914e9e307d9144e78bde5e65b80a524e80d109cd4b3bc546d4650fa84752bc7ca70ac06c456bdd3953daf57983a12a71ad33a861f8e5741cf0ef55

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
0c861b4abc7a73f32cc959b0027d8c47

SHA1
f213f21bd1886a927b3736341dcd6d6bbedeeb1c

SHA256
aa5ed96ba146f0c425c8141f39315e00e0f3be723b0b718ed1218eb0877b9f6b

SHA512
bf9b36036bdb122df33bbe8e7db6c67051b04f68f5524bf0c10a5047b31bf8c31b01f2a4e1ff22f444a872630ed500f11199fa8f4872cedb1fa86dea9ec6b598

Download Submit
memory/1712-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1712-184-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download