49e44000da021b5bb13531d8f3b6ef4b95799aedf81dafbefd75282b67d26560

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1929c1d78fb7bdd035d44233455fcfb0N.exe
Size

70KB
MD5

1929c1d78fb7bdd035d44233455fcfb0
SHA1

1cd2878c4a9e3732294d4a6dd515f40031968ecb
SHA256

49e44000da021b5bb13531d8f3b6ef4b95799aedf81dafbefd75282b67d26560
SHA512

49a7a264d8cdfca69859d0d9669bea9a9bab578c094bdeb545074c4a6a5ab020a7e1cab3cb7e8e3f0164475a31cf2810d3550c5e1d6926863a94045460d0518c
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8+g9VyjVyN:fnyiQSoi

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3100) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/292-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000122e3-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/292-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	1929c1d78fb7bdd035d44233455fcfb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1929c1d78fb7bdd035d44233455fcfb0N.exe

C:\Users\Admin\AppData\Local\Temp\1929c1d78fb7bdd035d44233455fcfb0N.exe
"C:\Users\Admin\AppData\Local\Temp\1929c1d78fb7bdd035d44233455fcfb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
70KB

MD5
83bae5cc5416641d4d9026939f3c3348

SHA1
de99366526f3aff5f7b15fcf3ee2403de4a4d283

SHA256
1364abfe6ad6ca8b8cc4f5cf25732b2ba4f737149105933bedc3a4feed5dca96

SHA512
8077ee32b9b558786db0077c4843eefd5768c16c3a15d3ce2bf7e73eee1150c8338f94caafe86ba05903eedd7d66086dbae92008565a480782695f9aeee541e9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
dab317a5a168951a6ba6ccd7f2477c11

SHA1
bc4a8d7ceba7c0bf1d40c473d90492235dc83f77

SHA256
897d94b437854860bb7552215d33f0e63061c650e464a7ef54a87af4c2a838b2

SHA512
aea31eceb33a495c1138010a2b774f78444fd76e4e18c8889f62ed1e0cbc97e7f5d725742201dd9d7684e6b707c3faca258329fca4feaa75afa6defa6f21a5c7

Download Submit
memory/292-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/292-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download