e84a1e04e8b2ac0833eb88e5587bc84fdc97d198c869efca3dffe51a4ddde985

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67972c019e05cded1ffcc339f4d383b0N.exe
Size

54KB
MD5

67972c019e05cded1ffcc339f4d383b0
SHA1

62307f2a3db8315c1f633aadb9813950146797ba
SHA256

e84a1e04e8b2ac0833eb88e5587bc84fdc97d198c869efca3dffe51a4ddde985
SHA512

6fad5cb42864987d6065acf98f5683d12beda5bca72b0d311fd11f1f00a2086f222a59a299bd4ca990050b9f91754e5c2a9089b6fcd8a79c50e932a3a952b1c8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rb:V7Zf/FAxTWtnv

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/1640-658-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	67972c019e05cded1ffcc339f4d383b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	67972c019e05cded1ffcc339f4d383b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67972c019e05cded1ffcc339f4d383b0N.exe

C:\Users\Admin\AppData\Local\Temp\67972c019e05cded1ffcc339f4d383b0N.exe
"C:\Users\Admin\AppData\Local\Temp\67972c019e05cded1ffcc339f4d383b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
55KB

MD5
2239df0dacf03792db379198955b136c

SHA1
b5959c46e5dcf7202db2ab51d2edc1882aefa8c2

SHA256
85a881d249b044cab6e06079c8918f14dce5b373446f963b2f203ee7774edc68

SHA512
d1a9718e04946e1af9590f919a1835e35d84ee272ad6fdd9dd6c42f1d62b801fac3ff8afb78de5f18af9c4e6b4de8908924cee204d6f79c87c520e0adec13a58

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
a4db8370c930fae24a7a507261eb3eb0

SHA1
e285e74d6e2339c9f840666946c2f8d6895504ef

SHA256
ae75ee31da2e90101b003c4b014f422985adf9332a5880c4553a2b1a9eabd591

SHA512
0233cc664869ebca1e93e320967ebf397d740d643b84d4d5043a0e94a53a5cd7cf75b03e7876094f88de83029076b0c88feb5192b6c49830236d213f40a1a912

Download Submit
memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1640-658-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download