3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
Size

57KB
MD5

04d5fe5d30b33db9a234754f124f3df7
SHA1

93f66cc3a3a09ca6a63c3467528658f3a46856e8
SHA256

3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a
SHA512

427bebb0be437a389e410a060eaf364387406beb3f5082d34f720dc8f263b5a5382338913a41c7704af8ef9fb2f2a4ff16e4a1548015468d30de2b9d57921461
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFza:CTWn1++PJHJXA/OsIZfzc3/Q8zxY59

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3765) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Media Player\wmpenc.exe.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Media Player\WMPDMCCore.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\gadget.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libalphamask_plugin.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Journal\Templates\Month_Calendar.jtp.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe

C:\Users\Admin\AppData\Local\Temp\3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
"C:\Users\Admin\AppData\Local\Temp\3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
57KB

MD5
25d976982d26da412ffe1c49c0cf1fa5

SHA1
5795371099a18fcace63fbc9c95bd50818171bf1

SHA256
78ed24bcbabe3da3cadccd32ce2dc341803821846d0567b73bff96d7833a65d6

SHA512
9b608e3cff27b0290272e968ccced3c92a5c30718d41b99b75c5cb701b26470c4d4304ae90aa6dda34e0c20195db0f7155657c46ec0b505dc2f4f56e83218f68

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
bec9ff1940e9c447a655816c18e0c72f

SHA1
4d3ff7c645cd92bda72df6585910add07009b27c

SHA256
b81fb0b6cf3a71a6a9a1958d91bbbc88a47756a00546651f43942a9c5e24079d

SHA512
eed32714311bdc694623abf278a230fd16ad2113469ffcc55a3d6699528fa91fb4c0a3c10c7c36dc346557b10abfc51e23e663ab68a765b542e960ae8f102864

Download Submit
memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download