95986e841482f39108ac68b082c0162c66a2d064b219bc82346ae7ec9f3e0c96

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac25afa6716fb037a34327f95852da60N.exe
Size

69KB
MD5

ac25afa6716fb037a34327f95852da60
SHA1

7babf89c49f7f66d38059d5116535bc00c0b1382
SHA256

95986e841482f39108ac68b082c0162c66a2d064b219bc82346ae7ec9f3e0c96
SHA512

43f858f1567b4ccb5e7fb8b93f1b10fef4710d9a55c9c20e119867a1d4b1e337d725732ca52d585749cee60a7092fad411136437faa759c16ed601f56cd2578c
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCN:enaypQSoskS

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fd-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/3056-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	ac25afa6716fb037a34327f95852da60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	ac25afa6716fb037a34327f95852da60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ac25afa6716fb037a34327f95852da60N.exe

C:\Users\Admin\AppData\Local\Temp\ac25afa6716fb037a34327f95852da60N.exe
"C:\Users\Admin\AppData\Local\Temp\ac25afa6716fb037a34327f95852da60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
69KB

MD5
3530d1a5f2db30b7cce0aa2f2f67d3f0

SHA1
5b79836b962bc3b73b3754fdd0bb5c782f5175fb

SHA256
6beaabfe4bdc26f42e4814cf0504e112a5c6e5724223433da24881c2b7b9239d

SHA512
d1d3bc7d8b466177bb381bc626f9d4b08d181415d2055cf5aea99a36c4c67811e4eb6a5eb6f5f447e3f8ebee8a39bce19f16b51c8554bb6cc8b331538581f30e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
833d45f52086152f49ffbe608bffa69b

SHA1
637dc9baece135e5f754991b7a66ab9f14fb21ad

SHA256
236569f02a3baf08ba707dafb826eed8cab2b5cae0805a81123f918c6450b539

SHA512
66f0cc8b896e5c7aa3b3ed56b257a0db60a83ae8d9f6359d2f93ef1847190f60c35f9d7a5d57d0678a92704f97ecdda8b35769ea4643c6210e98de34959c1693

Download Submit
memory/3056-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3056-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download