d5874243171e427b6aa816e64fc4f308bc2998fadd2b88b9a31c77280c914ce8

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64fe9b614e00607f713ab6528c390e90N.exe
Size

49KB
MD5

64fe9b614e00607f713ab6528c390e90
SHA1

40b560e9bad434c699e007113dfa94e2366c6ef4
SHA256

d5874243171e427b6aa816e64fc4f308bc2998fadd2b88b9a31c77280c914ce8
SHA512

199fdf70b1788850704087ed10ca1d4f755affd1dde5dd862d3384b1bc3485341f4dfc5c5ff4a7ae0e9712cea7f248d14217bc0238b1001c019c649a4ca7b2df
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzX:CTWn1++PJHJXA/OsIZfzc3/Q8zx5

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1380-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/1380-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\bin\javaw.exe.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdshow_plugin.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	64fe9b614e00607f713ab6528c390e90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	64fe9b614e00607f713ab6528c390e90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64fe9b614e00607f713ab6528c390e90N.exe

C:\Users\Admin\AppData\Local\Temp\64fe9b614e00607f713ab6528c390e90N.exe
"C:\Users\Admin\AppData\Local\Temp\64fe9b614e00607f713ab6528c390e90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
49KB

MD5
b3c8f149bad2e7eac88bbe9ca0585f50

SHA1
68b644831b86adb75f8a13c04fbe811f05d069a7

SHA256
5b94a88b7137a08e8dc6aed3e91dcc5f9c26c3dff69c3d191baba9f3b027b467

SHA512
431394cef48391d87b18c30912119afb5660dec47a32ef71cdc829368027a61f922a4cccc4f8c6e54fce2109626c6edb6a63ead2e43f06138fc2d7c42697c3a2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
20c38b9471c548240759d368ee6ea264

SHA1
5ea50232acedd6838626ffb5e9af76540cc8caeb

SHA256
314e51c3284523de5cff90c28c302f25709cbf71ab4649b400c18393e39e6ac5

SHA512
9fb645597e0a9655ed34ff518d32093ca685f33c52478b4c03710770bfe6951644d9af635fb94d5d84286d1750293340a57419a277574351feb8476437ecbeec

Download Submit
memory/1380-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1380-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download