b64c8435245a05645a9ea7dc8a781fb679edd907a5ce39a4fa62d658b3369a9b

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

714e1dd12f3818f1af8cc5f35b35aa90N.exe
Size

45KB
MD5

714e1dd12f3818f1af8cc5f35b35aa90
SHA1

daed3b188dc2d46d4ae740e9483f85859d5dbb32
SHA256

b64c8435245a05645a9ea7dc8a781fb679edd907a5ce39a4fa62d658b3369a9b
SHA512

25bfc693f1d5e72ec3a97d5a501c1d14a75428f417f902a43dc0f0da6fe95fa06bc47f26380a1219f8733558bd08f7ec2db99097675594c1f0fe4fb396d9fb43
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy934Ubb34Ubs:V7Zf/FAxTWoJJZENTNy9osboss

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2312-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libh26x_plugin.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_xml.luac.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	714e1dd12f3818f1af8cc5f35b35aa90N.exe

C:\Users\Admin\AppData\Local\Temp\714e1dd12f3818f1af8cc5f35b35aa90N.exe
"C:\Users\Admin\AppData\Local\Temp\714e1dd12f3818f1af8cc5f35b35aa90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
46KB

MD5
e4ec475c819d15aca56ad0c52e579b97

SHA1
41657105dfa6444a3c18afdf35b7fd8601871e06

SHA256
aa72e3d30bbf4b8546d659aced53ab1b4ac3d5ba1d953411f5aec95125bca314

SHA512
0f18c9f0805cfdcd2df9537ff0a0f2d3c5cf8995b0f6d1beb1af15949a654e5d42444640b0257b4a9f69b2a17d4d408302a7449a0574ce9c93756c2f5216782b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
54c94337d89d2520826c6aaa2b4f71a3

SHA1
f1ecdd27c7d8533bba557c0018f00da1cdc4e27e

SHA256
d7866d5fa9d1fb30ac3091dc09f8a289adc3b309bf1c2f8c5c85d20b3f113eff

SHA512
8d2a79721893381e9f9fea990e2dbd68859c551fa4acd75c4b73fdd2ccf600f2582058a585bf6154c1605d570835c014aa9a5f664abb161b9786a1892024e6e9

Download Submit
memory/2312-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2312-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download