b01299f3f52a32ac79fc1be02916edb0d001897473159da29d1b615f5e8297b0

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61b336974216d0e7c710b704a2169e20N.exe
Size

70KB
MD5

61b336974216d0e7c710b704a2169e20
SHA1

bf93d7a996255c3fb48c3048e8d56ab3a83036b7
SHA256

b01299f3f52a32ac79fc1be02916edb0d001897473159da29d1b615f5e8297b0
SHA512

be4673607991d79a12ecc72190191cfd617e093ea9d7a8a3b79a52efa11b158087a595e3af694859f0ab4d3bcd8319689cb502221988211f6c72df6b6d12ccb8
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsK8/8H:fnyiQSohsUsxkH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2897) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/1908-536-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\PingStep.css.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61b336974216d0e7c710b704a2169e20N.exe

C:\Users\Admin\AppData\Local\Temp\61b336974216d0e7c710b704a2169e20N.exe
"C:\Users\Admin\AppData\Local\Temp\61b336974216d0e7c710b704a2169e20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
70KB

MD5
545c315adf6eb29f883f782eb1deab6e

SHA1
7528d943d618e5ec1aa866700f77154039b339a1

SHA256
eba1f401c2c49d10f7fdc1b1eca335d8266ceb88965b1d6c1bc909a86ecc10d1

SHA512
c6529107619816614e5a0cb32a2552c3d5296a43a4c46e5eb6740a1eed727bb77fe7a53433f54dcf8c77d60180df52b2978b49407cd9cea80ca1fc3249576352

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
0f9caa181dade3ca2bc91a94d2a21e59

SHA1
4b47eacd6de95c83cbee2726ff90b8704596710a

SHA256
214c3dfe29ae7c3186c539d286178e925d54c8ab4b485b88f751184ac28bb87a

SHA512
840c0a98e7d5382b28f33a1bc2f2f280fd382b2aaf66cb606ade2fe789900a4a5bc17df577139254dc16f660201948172d2c177618e8bde938b3e1e323d777db

Download Submit
memory/1908-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1908-536-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download