4a0e54dd35d6a0fb3066f4e843fc93b13f345398318cada4802af1e30ede9cda

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8982a7b2b019c913b7722f97bb3a8030N.exe
Size

68KB
MD5

8982a7b2b019c913b7722f97bb3a8030
SHA1

ac9f8c472479486d2e48f0b20270a3a058b66559
SHA256

4a0e54dd35d6a0fb3066f4e843fc93b13f345398318cada4802af1e30ede9cda
SHA512

8b2dfbf190a9f4d0667f492dd92be3e93068f197a930caa58cc5652295a90e73d6119393eb6c05e072e7c98ac10983347b88e152feebd57c673ccc5c08e57d7f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rA:V7Zf/FAxTWgGpGdQuEzEH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001225f-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2404-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tijuana.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	8982a7b2b019c913b7722f97bb3a8030N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8982a7b2b019c913b7722f97bb3a8030N.exe

C:\Users\Admin\AppData\Local\Temp\8982a7b2b019c913b7722f97bb3a8030N.exe
"C:\Users\Admin\AppData\Local\Temp\8982a7b2b019c913b7722f97bb3a8030N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
68KB

MD5
3b60f07b6cf03bf099dad3ea1a830977

SHA1
be401a8dcc5aa6d545c89a084972de710ebe4aa4

SHA256
81fb17cc182abb015c1c6e932832f53de2764fa8d58b62b4b099f55d3a28b554

SHA512
fc76f09f7055dbb92fe6774b248b7bec2b66ae5e0d15169c7f6cda6513c9303cd5804c9e7303c6f2f2bbb6fdb469deb560d7c757796e1747a64ac278f20c3e0e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
77KB

MD5
3665d51227723c0dd008f0fcca9d43a1

SHA1
7a31c097caab3a1d31de8dabf258ee8a2c22cc55

SHA256
d8683519ed6a0f13042012b490dedca08d11a97e195d1b527e457e5360894fae

SHA512
35c91d8d7bf8fe6604ff478f1259844e058e4301f0f1d2f932d5716da84b5615897a85df51d847ad03f2f971c1c77121062150efe3cdfc1fab3ebcf178e1ae93

Download Submit
memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2404-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download