bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
Size

58KB
MD5

e7fccaa69f1646e1b9bdb61a5a66d67b
SHA1

9efc10d3acbf24ca62399859870036fae5f58d3d
SHA256

bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50
SHA512

ccf6de664457fd0abd451494721763edf679d818decdad065be8e5809c75256e354d5d69c7b074861ea8c2c179e505e37fa3eb4f653f9bd520866c5b5bd91f2d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mHk:V7Zf/FAxTWoJJZENTNyl2Sm0mLB6uIj

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3525) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3052-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e000000012014-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/3052-532-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\picturePuzzle.css.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Journal\it-IT\jnwdui.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libpva_plugin.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe

C:\Users\Admin\AppData\Local\Temp\bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe
"C:\Users\Admin\AppData\Local\Temp\bbb89f441e32a35ce7281f1785cc68112d0c106f74cde1617b8ac1738bbddb50.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
58KB

MD5
793fbd0abb718f4bbdb129ef3821d32d

SHA1
1bb5a4a24040b980f9e2fc1486a35fc3bf6fd3d2

SHA256
8e999578e4e7b4eac6abd6bdf068be2c33da079c33495b3a2af857da3ecee051

SHA512
738403f24c1b4f512e4f7159ac53b579e7c4a6f57c765b602e0db2742e026a70889920b38870e9dadba02e25483614c1a4d5fd9cb4cf93416e49a8c8929a556c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
f0ba855feafad9dc79c436311abe73ed

SHA1
6f6153fd1ea191da40e0ea341993f7cbe118cbb7

SHA256
249f193ed0ec519b9daf13dd55bd10e727431681931e6489d86e243fead0daea

SHA512
94b1d99255ddf8fbdc76c3f69cb45aa04ce272ced137df3252898582cb9bb5eb06535db76fca29e8b5664967027fc3b1f7b19610b7845673a1796b0265fbd8b5

Download Submit
memory/3052-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3052-532-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download