d809a71dff6798b87c74f3bd472e13305dc7172ed61bf9e182383c43b08da393

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9242b7b74c5ab9286127defe290ab60N.exe
Size

81KB
MD5

a9242b7b74c5ab9286127defe290ab60
SHA1

814b48e9a92a0ee02bc6a78caef2342f6e0e7762
SHA256

d809a71dff6798b87c74f3bd472e13305dc7172ed61bf9e182383c43b08da393
SHA512

f66002f31edf9ae465d6e3e456d87496d181d6492144279971c247c0a9f89ef9e0b3eb5d178966e40009b26d8cf1c7916952d43012d0ad570b135f15f7eb8d7f
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2IhQkQ6:fnyiQSoDuXuv3H

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2116-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0005000000011c2f-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2116-652-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp	a9242b7b74c5ab9286127defe290ab60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9242b7b74c5ab9286127defe290ab60N.exe

C:\Users\Admin\AppData\Local\Temp\a9242b7b74c5ab9286127defe290ab60N.exe
"C:\Users\Admin\AppData\Local\Temp\a9242b7b74c5ab9286127defe290ab60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
82KB

MD5
1e25802bec26a5bd0577e41d93aa9471

SHA1
a54a7bc446baba08533c57706354c08d983aaf8e

SHA256
70aa1f35c62f1a403bc4f3ddd3c16c798039cd73a999de5729d893574a7e18f5

SHA512
2efd3df025822cd8e04d1b56368e394f1d14d93219a292bc09024e44e1911066a0b2cd7e00a970983f19366e6ae7b1aaf43573fd6423b56e4aaf35e24f418f11

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
91KB

MD5
67e76ccea976b70e5d5c4f81f7e622a6

SHA1
54c0f83db092961cf99868b58c92b8960dcd485b

SHA256
55e8e9528925b162bfff7f0009af1627d271c89c275fd31d853c3ca4e2b4803e

SHA512
23f20dac436d10ce00f260b2cd2b57e069dd7267ce4854667a17554762aaf3908a9989f450d29f3742e4590f7847db71ffdc9ee6cc785e811b7993d06e64f41d

Download Submit
memory/2116-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2116-652-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download