92ae11c43a3e8e0ac67d9028a16565d063f81915855dd555083094cebec15690

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48c1a80ebe58d9387260c106830c8100N.exe
Size

52KB
MD5

48c1a80ebe58d9387260c106830c8100
SHA1

fad1aa911c2a1597f17c47a2ee8457523ecc6f95
SHA256

92ae11c43a3e8e0ac67d9028a16565d063f81915855dd555083094cebec15690
SHA512

3af0a1f2b5e5cf09f11f36983b40586a21806cc41d92f964b223f0229b4b35dfe856f1446364a182590859b6a9ce42a5d7a7158125206863d99f4bf90022b224
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKjm2:V7Zf/FAxTWoJJZENTNyoKIK62

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-2.dat	upx
behavioral1/files/0x000f00000001045a-6.dat	upx
behavioral1/memory/2060-658-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	48c1a80ebe58d9387260c106830c8100N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48c1a80ebe58d9387260c106830c8100N.exe

C:\Users\Admin\AppData\Local\Temp\48c1a80ebe58d9387260c106830c8100N.exe
"C:\Users\Admin\AppData\Local\Temp\48c1a80ebe58d9387260c106830c8100N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
52KB

MD5
0f1eddb92ddc16aafcb02a8e7c1f999c

SHA1
e44295ee2787fb38f82e282ae1a19f24060d9632

SHA256
91126c1377c8b52a59240b8d78a0c537cd76cc1198287b93a7b2ce350bd611df

SHA512
dba4b39009cc0ec0021e31dae63b9b1b04c6bc955dde71fc03b7f2b23e4fb4d2d406dfcbbf901b5e57a99e1a5595b2ba077f960fe59060535453052a48b38e8b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
9d3749c0b665b149f1c4885042e8d6c4

SHA1
057bd4e1958897eabf9b880e5f97d48ba18db579

SHA256
98ace715c6f6215ce44e668ed2eaa4ce7379b246bf0c9d69cdeb1f3f15f790f0

SHA512
1dabf8cf0e4e507a847f5420e3675a71342b0ad997cc0f59379909e047cec4584e2c20b47ad0d7956185416bb8fd6ce064ef91fc50e0cbdb95cc4bc123a5962c

Download Submit
memory/2060-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2060-658-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download