73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f

Analysis

max time kernel
150s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
Size

69KB
MD5

0934c66a2abedefad6e72116d6ed5738
SHA1

26734d03c4134856f6611dad0fc69c795599f57f
SHA256

73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f
SHA512

aa716742715dda22f574ad4576d300a85dc3d7c86a9d8a1449267f5c28be558f89eb9806af02ab4632c666bef3cd71e0cb9c2a02a979f41d241ae40cfd6c57ee
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2ro:V7Zf/FAxTWgGpGfKEqhKEq1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3752) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/2716-662-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STC.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_foggy.png.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Journal\Templates\Music.jtp.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\weather.css.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js.tmp	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe

C:\Users\Admin\AppData\Local\Temp\73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe
"C:\Users\Admin\AppData\Local\Temp\73ac6cea4233159c6a02536cb65306c1305e40af0a13d4de512db1217f252f1f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
69KB

MD5
5f80ea2f6531898f959c67db7a5bcd0b

SHA1
90f54bde813188747411b59529485a3836091c8b

SHA256
d3dfb9fcde4f534f6be76748680a5faae46ba4b1146e4397f18588e33b79ace5

SHA512
278080982d3d8c3134240e6910fbddc9a0fb7d7154b5b567241ef4fd1b77dd26e69e4c3ac83275e343cef7a66312368d86fb135be3a213132bb5e270aa053d24

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
2655b9797c66af68c433bb16a3ef2957

SHA1
3cd17b862dd8fd4b6f2599b75933a27dfea909df

SHA256
87e80f1ee1f64b5c66087285a014ef164ffd151795d13cb4d4fd4c5b5f2416ac

SHA512
24df6e33b3f0c036518773378e801f785abe4a37993e8ed6c83e59b5bc1375435d88b3e0785285a6a7f97309b281e51ffbae5c566ff5749c6caa8d8bca3a5b42

Download Submit
memory/2716-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2716-662-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download