23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
Size

87KB
MD5

6bd0e55a89557fa081be1855778f723f
SHA1

90919ba631ec43b425efd76513848ada615da556
SHA256

23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c
SHA512

69c3f508d4e8167ef6a8cb6ffa4c8175b22bae45b48dc94f736f2d5e2dd883e6c80c6dd0ff1ee87abaa4725bae69462f35d599b3d59140374ee09e95fae8b58a
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZv2v+6Q:fnyiQSo7Zv2vi

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (575) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000900000001227c-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2364-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe

C:\Users\Admin\AppData\Local\Temp\23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe
"C:\Users\Admin\AppData\Local\Temp\23307808df0c493bb26076faa3b132cdb5f777753b61952ba692fee4dd3e985c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
87KB

MD5
a0c1e4c6ee592d87f63e191fae81d037

SHA1
d9bea9da1b7c03ece8085e384a7bc76860ed30ba

SHA256
f904d4a3b6a4920e8ee39b37f3cae0214d7a4374052dbc4f126c91ffe01e0399

SHA512
4b824466377279a784621e88b0057385778a2c70635f9ebb69b046b224775426c0fbb7bafdea273fcd8f811bd34d5696d8a00f5966872d9ce6aa25dc2cc23e8e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
fc7fb38f164da50ce7449f00328f706d

SHA1
a9b97b481a0a93fee2c07a0689f03ce4ac40f9f5

SHA256
990a8b5e9ce74e4d7c10a214d4c0a38d461ea9bb7a75c508e220054d7420986a

SHA512
b9afc591d088872ede11566e9caa295549be1c44873b8a2c4db5a3c3f12922fa330ae914c7c07bb780f3764a688e7722c18f4bb75d99e1802d601d353f7ca71e

Download Submit
memory/2364-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2364-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download