98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
Size

28KB
MD5

8ceef7814a0552f57907d6fca6733940
SHA1

3a01c224c371185f3d4e3f10cc403e7829bfdfb8
SHA256

98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2
SHA512

f7190a734a83cc9e3dd8af1efac39a13b7f43312594baee27928bac0fc932d134d5f5e8a09209a44868bca01bf4c86fd0ba7a3d33c0f3879d2f27e9672a77090
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PD:CTW7JJZENTBHfiPD

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2364-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\sqlite.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe

C:\Users\Admin\AppData\Local\Temp\98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe
"C:\Users\Admin\AppData\Local\Temp\98812de6b363561a107c7c0091aafb379564a7f2b92cf53f050e2a0ee096aeb2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
29KB

MD5
5bca2bce4a5d4510e6bafce460623982

SHA1
a6690caced0708ecc3a1ac10b1cdecf2e1428a71

SHA256
bcda6eca28c9b88d8e236ff42b8aeb3e6eb9e0de2b26332ba7314fcd49eaf28e

SHA512
28dec958dc294f58d800a52f88956059c94899dda5a7f8a307e9a69ba8af683b3fc6ac13124543e07e0f9bac3fb7c2b506f6e8b7c669ed3bcb5532994bce252c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
37KB

MD5
11869f3b3df57948264771576b8bf88c

SHA1
7b09130abf6fa6a53ef708c79b41fca621556e33

SHA256
5c78f1130af7413c5d5e3c9c4109a8397b3a3bbe77a623d24cbbafc35b23a3ac

SHA512
7e5ac9b72c2924a693e8570905d84035193032b8d5a314267e7d5526f87f1129600b9b30246499df6167d24a0cdcafb91af2722811ad067df31244a03cabc75f

Download Submit
memory/2364-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2364-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download