690ae32b0d953b3eb797fd83b4f4da452b881d14c5cef94f5f0c2509aacc376b

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b2e63270a7455585131b37c92a67e0N.exe
Size

18KB
MD5

05b2e63270a7455585131b37c92a67e0
SHA1

d995f2984549af46434cd8c093114c50f11d49f8
SHA256

690ae32b0d953b3eb797fd83b4f4da452b881d14c5cef94f5f0c2509aacc376b
SHA512

2a9315fada5bed28858a8688132cc049ca7b1bc6c51f6c67e015cc9f57b6dc3e9047e43b8f72ba6305934cea96af0cc2e8f3b85ee935bfa4b8abe4051aa5e364
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJcbQbf1Oti1JGBQOOiQJhAT17eZ:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJ/

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3271) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0009000000012286-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2416-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiler.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Efate.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	05b2e63270a7455585131b37c92a67e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	05b2e63270a7455585131b37c92a67e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05b2e63270a7455585131b37c92a67e0N.exe

C:\Users\Admin\AppData\Local\Temp\05b2e63270a7455585131b37c92a67e0N.exe
"C:\Users\Admin\AppData\Local\Temp\05b2e63270a7455585131b37c92a67e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
19KB

MD5
211fcb81fdfb4548e04b17aadec923be

SHA1
5e68dc7f3885dd527499797be92aed08419c97de

SHA256
32295bf6c55bcfc815a2a019f7aa0b56c6ba681c8563cf32c90ca4d093d33646

SHA512
fb8784ff59682616fac6575dfafdb5709e3d8d4c691a46255e81bd7d7521292f677ced6c5999a77ad7af70d371796a5c80cb9861be06da90fe35df77a50064f2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
28KB

MD5
becc244f4dce059feee4dbac7a329bcf

SHA1
7f5009a5058cd2d57c5b7ce28b01b2418ec4a939

SHA256
9004ccebd065092e9d3481f677fb91d4445dc63ef17b23f97955e4f58cd933e9

SHA512
61e29b19b2641d9227e3005172d66e3b4e80f7407cc7b4f90e3c794f8da7716a6172ae37440e9c761eaebcf88c9436a5652b5e5399ee777c1626ec33a990ad8b

Download Submit
memory/2416-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2416-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download