b9931a6cc49128e9bfae127e4ae036290d3bb8b3058ffd72e8e6118ed9372c49

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a832f5bc51040079adaaffa34009aae0N.exe
Size

69KB
MD5

a832f5bc51040079adaaffa34009aae0
SHA1

7a63ac94a5f1d994a6b50b420d296a89cdc2471b
SHA256

b9931a6cc49128e9bfae127e4ae036290d3bb8b3058ffd72e8e6118ed9372c49
SHA512

17c9678d9a8ee4d709f8af91a21233b4b10ec64843b68acc7f82eed7a2daae190836179871a6ee1e2a40cb9f804da08112b1f3c6e22feb3d283364c0fde98864
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fC3:enaypQSoskE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3277) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2700-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001202b-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2700-666-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	a832f5bc51040079adaaffa34009aae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	a832f5bc51040079adaaffa34009aae0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a832f5bc51040079adaaffa34009aae0N.exe

C:\Users\Admin\AppData\Local\Temp\a832f5bc51040079adaaffa34009aae0N.exe
"C:\Users\Admin\AppData\Local\Temp\a832f5bc51040079adaaffa34009aae0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
69KB

MD5
3df282875a61ab218d50d48d30e6d5aa

SHA1
4e9f5e39e9bfaff671885381ab32a9986d6910f9

SHA256
7a562dcb6e672b3594754f835514d7d1e553aadadc0e4d730fd4119d4dea1479

SHA512
20d535c1e73eada9c5b6980553a1058ce74653e59c7803ee646f46bb577277ed130d6cbd0199161d007e268f64f19093eaab2870f5204929d73d63e6a8866a2c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
704c5be886e7f7d2b481ecd597328d68

SHA1
4c4d7f70e1d849650686f362a1cede7c13ebdda6

SHA256
87dcd0230545d2d97f3220facccfda7b57b9c447184be47231db80cf1323beb7

SHA512
555da1e9da07c9d3f07dd11c77e3eedc2d8e2b76bfdb5b196ab900bb558eda956b8db97f258237efe0be33a9ba69142eb115bfb5b7e45c339bf48ab5715b458e

Download Submit
memory/2700-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2700-666-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download