42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
Size

46KB
MD5

87ce7a73ba16a6ff99ec11b69ea0d89f
SHA1

abd0097fb82f9396fbf0abc5215ebc5745452ff0
SHA256

42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190
SHA512

7788a91464ca040dfc5da662fa16d6fc18e961fb4ed3f94a894a986832b1b92e7f4225a8e3141728497f113f1c4007c0d8388a1a41843fed919289a8e66d61c9
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJXGiXZqVP:V7Zf/FAxTWoJJXUVP

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0009000000012031-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/2728-646-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_es_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\gadget.xml.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Journal\Journal.exe.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Filters\odffilt.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.tmp	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe

C:\Users\Admin\AppData\Local\Temp\42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe
"C:\Users\Admin\AppData\Local\Temp\42a893f789e3d13ae11c7f77c8b78efcd0c4d93472e687c6ad47fc0101526190.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
46KB

MD5
1cf810d0177efadde947218f37404b96

SHA1
d2412aecbf663d2afe31f193b830ee424c84de4c

SHA256
2c1d680dd08296eb41e02c365d94d069a72dc3579b9c724f0b894569069f5815

SHA512
320b1d84601a5df5318067ae6272b3ce7556368425063a1d521f4c5b4d6cddc15217f7f519626d183b0ceb3a5eadc7196d9611efb5527dd6e87297415314e0c6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
55KB

MD5
234070b9ce05cdb668189da2af3d3e65

SHA1
de390c29ff1658cfac9589d27e32eda2078d801b

SHA256
28be736a0864476ca7205ab3b6414a4888f81f18c017d88a98a507f915c580a3

SHA512
06876c72ae1d6c71caac8d08459c5c60083a9e5826ef8a8df0f9899104933a6a05d37909f274fcbff5d44143a636d9bf7662d4913eeaf37f6e9476333162d928

Download Submit
memory/2728-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2728-646-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download