a9e16f6c17371ae272e35b945a2fe87d1999cc07704312e8f981d9d508c49594

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11063146dbe4eda3617dd638418c29b0N.exe
Size

42KB
MD5

11063146dbe4eda3617dd638418c29b0
SHA1

ba2c4a1e9975bac8ddfa4ac6362d694198501b50
SHA256

a9e16f6c17371ae272e35b945a2fe87d1999cc07704312e8f981d9d508c49594
SHA512

2da9fb3aae98fd7363582461061e40bc3c27dc331ff923546e2014aa1e4e5eee4d0314e488f921cfa2b8813f37dac381d19a4a19448413cc779ffba137fb066d
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti8cx8ojzcx8ojQocHEocHL:CTW7JJ7TTQoQTWojQWojjqXqL

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/1620-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\RestartHide.m1v.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	11063146dbe4eda3617dd638418c29b0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	11063146dbe4eda3617dd638418c29b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11063146dbe4eda3617dd638418c29b0N.exe

C:\Users\Admin\AppData\Local\Temp\11063146dbe4eda3617dd638418c29b0N.exe
"C:\Users\Admin\AppData\Local\Temp\11063146dbe4eda3617dd638418c29b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
42KB

MD5
b0157729a0cd1446ed274a4af02ea888

SHA1
a2eacac6fdb2f80873cbb0f5bd6bbc88d25514a8

SHA256
b3e87bb5e4e4e7150882cf05d258dd7950fd5e11f57093f20ce769eda120717a

SHA512
09e06f924d82331639305c96e61692f23479f668d4c721ce14e69100465fafa1cba3b16a8c8b0e3d018a0f086a168735135cd76794f20f1bca6494b86f1b6296

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
ac779fe284f32f46cba73baeb528672f

SHA1
b93f47f88d0405e1e7166bf9a68e4c6aea47d868

SHA256
cd67c4419e79424a3c5f1ee19c5a55b3eb9bd091987ddee3c4b96e08077bcb59

SHA512
00a2f0b09b0d79d4da58ba470340ff04e729abe92b4a6ecf335e91b9b4a304df611cfadca68d3011c4b0a1ca334bce9271362e3fe77775629d7c3b0338b4f44d

Download Submit
memory/1620-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1620-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download