98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
Size

47KB
MD5

d7f1abffcb21b9b6991cfcc28e2d32a4
SHA1

a5ec957e795fa02dd6886cbef49d80be16992049
SHA256

98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7
SHA512

a6633fa94a9121dcec0561306d810a63047245540604d15518ab6fc85828084fc336ba553f9f82d421c6dfefe3a54d55e736692ceb144ac2706b893347f44209
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFnn:CTWn1++PJHJXA/OsIZfzc3/Q8+dekej

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/2308-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\en-US\msoeres.dll.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\msvcr100.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\gadget.xml.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\AssertStart.mpeg3.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvcd_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawdv_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvdr_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe

C:\Users\Admin\AppData\Local\Temp\98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe
"C:\Users\Admin\AppData\Local\Temp\98604082ba502aecaf09f7b7d48bced86f374b0d03043c6d9a5195c00ed3b6a7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
48KB

MD5
ce2a796cae2cd288c279d9f21070ff9f

SHA1
0b15a04cd12455cdef2ae4f9f9cc145571016228

SHA256
cf3356521649ee704dec5a3357a4f4203a8178c24658f0454560f61baedaaaba

SHA512
f01b95f3e05df43fe4df8996e7fb7c94db1f648bcd2953d7c0a519560f9769b81ad45205ab2b1009488d8c5fa729d97aec0124e58a222c0d3f8831e61b038a29

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
57KB

MD5
b6a669a05173e7ad7f10beba1c48a87d

SHA1
b9a500de7f4a32709e63ce3e245bfe08c5a7fecd

SHA256
3585b214a38e9ad19f63812354d778f952942d97e7527a788c8c970627fa090d

SHA512
4138e892d43b9df0dacf061e7f2deb6575f0bba9ff477b3c102814c78f4eb304db352e7c8df6dc4d69e4c711fdea70498e5fa0285ce369b50d09a3726f2f0099

Download Submit
memory/2308-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2308-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download