a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
Size

44KB
MD5

cb1dc6c3a2e27a1e3bf9575f165d3c5d
SHA1

b5ee18e9a5c25c5831d40d3eba622fbe76717669
SHA256

a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726
SHA512

872649715c3921389d0091087bbe3931f896f02f66e45bb84ac99f62d7c656a82fe862615980fd6a6c47905905afdebd4d4cf157eaf31b5ca13ae8ded64d965f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBoMAJxeMAJxZ:V7Zf/FAxTWoJJZENTBn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3269) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1716-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c0000000170f2-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/1716-162-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\security\java.policy.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe

C:\Users\Admin\AppData\Local\Temp\a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
"C:\Users\Admin\AppData\Local\Temp\a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
44KB

MD5
445b54c993a544e4bdbe1f48ddc1b304

SHA1
66b4a07dde6f5d9070e7ccbcc50da0a2c2dc5a79

SHA256
32a8fa35ca9c9e397c469dd319bbb847e8748e8a95d6ae392d1af423fffb575d

SHA512
f0a325ad4be110e9ed24e67f98ea41f94e0472a6f17edd8c55c5d3180f413c091898a7dadaaef36316d24716bb748917d385ccbe568b812ee16a96da76832000

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
01694faf08326bcce3bcb15544330e31

SHA1
9e13ec90de2532ae17ce459770f874515924a08b

SHA256
206f172426a8a6c79ae72d3df09f46a6aeb9f3912d5544c44e41323ca40d2c24

SHA512
d1a99b3ba3ec67b6e92b1007ce8ade48f6c184d74eae7783cd6cecf13754faa291c32a9e4e4da03c1a797e9febb47440f9fd60cbc908d21bacef1c2ed9a41115

Download Submit
memory/1716-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1716-162-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download