358c8d36b69a99dc48d4c700f50932f986866714d5328efb650585eab264d42d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06-08-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d0df181a665dec658cf2c53e68d9120N.exe
Size

90KB
MD5

8d0df181a665dec658cf2c53e68d9120
SHA1

77326691866fc49ce3ca716b63a0e1ca39436261
SHA256

358c8d36b69a99dc48d4c700f50932f986866714d5328efb650585eab264d42d
SHA512

4d0886c3f51c34fb388da82c8ec8f7bcebaf7f11491db2e597b1e1128924cce3c7f2bae760cb6db4482f1a5f0c91c4559bf2b0cb70ba5bb8e8e49a9bfc55351e
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2IHD0N:enaypQSoDuXuv3HD0N

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001202f-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/2680-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\uninstall.log.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	8d0df181a665dec658cf2c53e68d9120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	8d0df181a665dec658cf2c53e68d9120N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d0df181a665dec658cf2c53e68d9120N.exe

C:\Users\Admin\AppData\Local\Temp\8d0df181a665dec658cf2c53e68d9120N.exe
"C:\Users\Admin\AppData\Local\Temp\8d0df181a665dec658cf2c53e68d9120N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
90KB

MD5
64926cc101a17d390ded0523d82a29af

SHA1
131c500bd129f2ed1bc87bcc9eadd1593a2de2bd

SHA256
273d7d6ba07807cd85a15096b1315fcba7a755a3241eb582805056af0c17537f

SHA512
1e8cd6ee12aae14b4ded796820b5c2db065accfadff4ad77a3fa96ef90f2dd846f8412362746b6bd9f05f052db08ccbc93fe3ae7739af6b84527a86b984456c8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
f4c43c5e0e30ef1832b3fbf60d0040bb

SHA1
aeb1119ff75d14cb55b307628c1c47558a775ed7

SHA256
468d38d7b3eab6d0740d41e91f6089bd6f1165d785eb8a5a2594a31555a5ef5d

SHA512
b64dcf6c4aa8f983676378687f91e01a3d5acfe829a794b689b8ba93052578cc900a3fe7d3250e2f11bfe37b1c3cb7ecdffe9164ac61d8e4205d5c92dc60ca0b

Download Submit
memory/2680-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2680-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download