09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
Size

38KB
MD5

64449d28eff3be33387dc542a65b17f6
SHA1

858c13b4cea3dc7715c36fd9df0ae34eff45673b
SHA256

09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c
SHA512

d19c903073cdc02dec0280935ea196287622c239a9f85873cd84f0052d301942eed01ad112b5343cd9cee79218e17d4cb500fb39d1bd1245124abcc5b5ad5b73
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti+plpUEzli1xcEzli1xM:CTW7JJ7TTQoQ+plpUfQfg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3856) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1824-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/1824-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\imjplm.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Defender\MpOAV.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe

C:\Users\Admin\AppData\Local\Temp\09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe
"C:\Users\Admin\AppData\Local\Temp\09b3416e1d7d6c8052cb6a8b9a45a86ee8d7b32a848be3ecc11714625f18e46c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
38KB

MD5
f966c51b3b79405e6e8e3530febe38ab

SHA1
aaeb1965b1ce366cc3cd0155467defb5e7f3bf7d

SHA256
efa5dcc788a9781ead638ffc41e96b3a13c3a545d4a6af0b5832f1623edbbbaa

SHA512
ff04329995170da08e38bf2f8635da53739883635be8e8dab208a8846ec5f15215fc916502f24988c09d868effbca74a5f44f35e89aec9f6a5803b72ec0d1f54

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
62b626a772ab6441368414c2d50230af

SHA1
e5dee79b1dad1dc7c81de3bc64f9d2596381bcac

SHA256
3ef44d826af556fbdfe66e7e970248525452168295d29885afd8a6c7a5488b6c

SHA512
97802df411b11a43ed382d43047ba36d6968a327b60631ecace91dc7035f25a65ea760ddaa9df718a7f420dcffa83a3aa371372729fe65ace3da57d416f8167d

Download Submit
memory/1824-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1824-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download