d3ebd8e58a5b6eb80692a2b3d9effb38bb6a977488811ec801cd71048b1e55a1

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a11dcab62083593c9c5ddbbf5f9aab0N.exe
Size

89KB
MD5

3a11dcab62083593c9c5ddbbf5f9aab0
SHA1

35ae75eb56faaa3113154976c458edb9ffc03d41
SHA256

d3ebd8e58a5b6eb80692a2b3d9effb38bb6a977488811ec801cd71048b1e55a1
SHA512

56b6267417660ef2e907a9413e82004b25df8622295b6058aac157cdd2b3684fdc5ef8ff98803283986d3247b7458535cd521839ae66a5d7e32cb7a52e37c318
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCJY5YHG6GH:enaypQSoskMY5YHG6GH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3064) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/824-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000012115-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/824-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\README.html.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a11dcab62083593c9c5ddbbf5f9aab0N.exe

C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe
"C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
90KB

MD5
58d585420397ce93520ad28d0fb16599

SHA1
0e975d255eb63800a334a2bd43bba1ad57389c99

SHA256
f632e98868b475ed720fcd21bfb4bd89ddb13bce0e13a8e296bac8646ac45345

SHA512
7fce77954377e3b8550f8c1ba5813d11d044269bf5f75c8996d7e0d640760bd80113061d97fd6983e7af7c6200a03d48065d250cbc4450a74d9d44ee5ab03b43

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
413e6e9c089cb4b9e8a5128743839e39

SHA1
3709539a2781a216dbbd4274981b7eddc9b93833

SHA256
dc295c07c016c78e04186d865cf073c1460d020d88dc5a012f36f5447cb9252c

SHA512
11395f28bb04fa5581ad0b2f5520f95f324312e9a00af0990dec9016ef79eae894713d50f3eeb907e02c951731c7d9d3b4757dad1d792fd605b74a72629d3cb1

Download Submit
memory/824-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/824-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download