14fb24628b6dc043bf7edf86f727f1224177ebe527d550b7d7d92b571ea8c578

Analysis

max time kernel
118s
max time network
23s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8330a8e57fbab8792504eab3353e8780N.exe
Size

28KB
MD5

8330a8e57fbab8792504eab3353e8780
SHA1

a219458de9aa1e471f77a77d6fbcdb8102f4e31f
SHA256

14fb24628b6dc043bf7edf86f727f1224177ebe527d550b7d7d92b571ea8c578
SHA512

4e7158ea7bcb4f11e946ae97e579bfd0944f61988bc787519e562b16e831b84ddef86cafcff7e0cf7b77753ae7f6451b330a6cf38a486e3001c9a1a906e51e4c
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lAwWskdAvIMskdAvIs:kBT37CPKKdJJTU3U2lWAC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2694) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/804-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/804-68-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	8330a8e57fbab8792504eab3353e8780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8330a8e57fbab8792504eab3353e8780N.exe

C:\Users\Admin\AppData\Local\Temp\8330a8e57fbab8792504eab3353e8780N.exe
"C:\Users\Admin\AppData\Local\Temp\8330a8e57fbab8792504eab3353e8780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
28KB

MD5
fe64ae773639010d348eff3b3e108639

SHA1
9c031678c454fa6dae2fffe9ae5d7cf499530510

SHA256
a2a96354364141b2aa560f1c58dc73319d36bc1f737dd4a0e6d6aa94a6437502

SHA512
72d5b29e9ec6bce1ad59832cc94baab70b6425bea53aa36e89b3e1bd49fe8574ddfcaadd0f777f4e5b0d77c8d3868d325b8874df30053f47fabe65ed1295ce1e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
37KB

MD5
5bcaf0e47c702f81dba379084e82d18d

SHA1
7c4e98da8df7f90d7d869940d0484186666b4bea

SHA256
be3a7b27cf42349ffd336d537105800fc46d73054c52a2e8827388cd6627a01d

SHA512
5e0c345ade76852183e25fd25914e638471eea2fc06fd8cbb7fef95710b7b09c649694cdb52761da655d2370dc9295de5452f3b9ef883946fba0bd121e2c96a2

Download Submit
memory/804-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/804-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download