a24041c01a13bec5711afe8e10b281696efa6c46dbf28acaadb49779507d9b7d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

573905ac2f031eb484aec6f9041a61a0N.exe
Size

25KB
MD5

573905ac2f031eb484aec6f9041a61a0
SHA1

8565fb103e54e3502adb42e6a34716f3c3126185
SHA256

a24041c01a13bec5711afe8e10b281696efa6c46dbf28acaadb49779507d9b7d
SHA512

555a69d6ff6aa402b645170790b6ad7859071014e2ce95759d5c6dccfaa2bac75991b3e96ee24e1dfb9b1f1cbc99e81f953b3b092bbc5ea6e598654f3de0a91f
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyQYG1z:CTW7JJZENTNyQY+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3390) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3068-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012119-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/3068-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_asf_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	573905ac2f031eb484aec6f9041a61a0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	573905ac2f031eb484aec6f9041a61a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	573905ac2f031eb484aec6f9041a61a0N.exe

C:\Users\Admin\AppData\Local\Temp\573905ac2f031eb484aec6f9041a61a0N.exe
"C:\Users\Admin\AppData\Local\Temp\573905ac2f031eb484aec6f9041a61a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
25KB

MD5
4dc89306d8fed98c83bf73c18058b495

SHA1
052d5b5c400b1701edd3914c5c78509cf9ac632e

SHA256
188c641e4c9785dca9ddd6e7925fc41af82b1ddf24d64e4f3e070f5c949bffae

SHA512
ff1ab67fc0248c67fcbada0be4d658668e8182f1fd0a3f6445e4d638f21f6d618200685157d4c837b59377669b3d62e515de1092fa40c51d1ae448708d4a9c1b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
34KB

MD5
a768954b4cac889ef7a96eb77c0630de

SHA1
86f97f997ca10d1244154c99ef23b62b48401410

SHA256
e2c5d7f88ab7f4328a6eb2cee78bdf435b31abee116ddb0ad4ae5b9aa9f124d8

SHA512
d00242bed7acb8b6cf50da399d34cff257eb85c96ea69a9f07660fb4ad8dd27e2cb2f4b8af0e001f3881bfda0ab0bf0a7d6759c0d60d657ba925fd14d0b88fa6

Download Submit
memory/3068-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3068-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download