88f82f79928eb837bbbe10aabd2033d33b5f829f7df38f6096085346b05e357b

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4078ba9faf4575d3b6681a6177b6ecd0N.exe
Size

54KB
MD5

4078ba9faf4575d3b6681a6177b6ecd0
SHA1

e1909731c35db42b63bed20eafa932bf4e1de81c
SHA256

88f82f79928eb837bbbe10aabd2033d33b5f829f7df38f6096085346b05e357b
SHA512

d985f0c2ee24cd9ebe62b0c3f5bf9e3f2b0bb95d45ea44d5aea30823a5679f6f1bdd4c778fb177d267524ce7d785f4386c1ca5c4e9fe86be7a9b1a06203fadbb
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rt:V7Zf/FAxTWtnp

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a0000000120d5-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2292-660-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\ImportSkip.inf.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Mozilla Firefox\libEGL.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	4078ba9faf4575d3b6681a6177b6ecd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4078ba9faf4575d3b6681a6177b6ecd0N.exe

C:\Users\Admin\AppData\Local\Temp\4078ba9faf4575d3b6681a6177b6ecd0N.exe
"C:\Users\Admin\AppData\Local\Temp\4078ba9faf4575d3b6681a6177b6ecd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
55KB

MD5
dc52581e274b4f6af8d2ad6c74db702f

SHA1
f4ab72efaaba949ed88b4eec8661e173d7747076

SHA256
8db657a10a3d8ba25727f26a7806edd882063f4c10ccd4858f1f45826ee6db5b

SHA512
d53574481edd74bd7b86efaaf11314ff7409b453a988977074af6c40c7ed8734e7a103cebdc6b6b4326ab9c69625c15d4a8d00802e032dbb81a8d37fcfc05c5a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
240dfd80976a34d369deff1174754ec4

SHA1
70c7d6b2da70770ad6a733c231774ef490982eaa

SHA256
6bb691d7dbb69ecd8de98870fc5aec4a98719e0f8f5c10951fbfc014236b8e7a

SHA512
4ef7bfc709784eb9b849186d0ae4527f6e5ca6bf4f67c975d8444e41573c0b71ea9a7f4ba958c4026fc63d39b577a22b152796150fe10dbcdc31b06b9ccf3a71

Download Submit
memory/2292-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2292-660-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download