214f47c538050b484d97c7d71478df1550593b41c83ab506b7707a7ffff38eed

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

011608cd5dd3dc4eff67f737f94a7920N.exe
Size

58KB
MD5

011608cd5dd3dc4eff67f737f94a7920
SHA1

c455f5d92f0f9ec0975c51c82e1bec6b70334ead
SHA256

214f47c538050b484d97c7d71478df1550593b41c83ab506b7707a7ffff38eed
SHA512

9b3a3a8b3b4121eb97c0870ff58ff27f3b553a4c9b7e2c129b5caca711b8c723bfc49a1fc72e5c25122cc70ecd21bbf80c2853237f1f69bfb9bfba400dade1c0
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zx5858ul5:KQSoo858ul5

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/2168-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	011608cd5dd3dc4eff67f737f94a7920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	011608cd5dd3dc4eff67f737f94a7920N.exe

C:\Users\Admin\AppData\Local\Temp\011608cd5dd3dc4eff67f737f94a7920N.exe
"C:\Users\Admin\AppData\Local\Temp\011608cd5dd3dc4eff67f737f94a7920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
58KB

MD5
3ef36c591233265be2eb209c614287dc

SHA1
9b154cff9bc0d86c1e474f4f6ce73b201a093e40

SHA256
88c977920377950f8dc360cd60468959b6b7757e603496e35f6b44c07272ae61

SHA512
aa2c44ed60498de3a82de9d4feb30376d86d7fc7c464acdc11cab2f1ad945bbc69e3492faccae99c8b8b26f871749679e116c3e4af9c989ebe973af55a38c7df

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
52347beac8bc47f97a99868fc8ef1bd7

SHA1
73d9776cbfd32a099d867f11fc8b58624b38e08c

SHA256
4c3a1917912ef78f7fca826c8170030681732f836a3e05074298bd06b9d6f3a3

SHA512
0c2192cf0349065f0d8fe9c92347d66e46bf912d16030f3a64972c234a497547351aa35ece7b2494e7884a08f1bd10b3b275f5eb8796580b0f395546f02d1f04

Download Submit
memory/2168-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2168-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download