489b0b912c25c4216eb7db4931100c250f49eece3991f076a6d10b1da86cf48d

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c59f75352d97c0ccd6518a6f603f8500N.exe
Size

24KB
MD5

c59f75352d97c0ccd6518a6f603f8500
SHA1

91ea1abfcac3c76d597925337867469323558450
SHA256

489b0b912c25c4216eb7db4931100c250f49eece3991f076a6d10b1da86cf48d
SHA512

a495ce505ea806a06fb311dcddd992b01a4da3b2f47ad09b772eefd48886c4a945fef789b3bbba15cae354536dd08bb2c59793a91bfa2aa5b0455070a1cc2b8b
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9W55:kBT37CPKKdJJ1EXBwzEXBwdcMcI9W55

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0004000000011ba2-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/2660-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	c59f75352d97c0ccd6518a6f603f8500N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c59f75352d97c0ccd6518a6f603f8500N.exe

C:\Users\Admin\AppData\Local\Temp\c59f75352d97c0ccd6518a6f603f8500N.exe
"C:\Users\Admin\AppData\Local\Temp\c59f75352d97c0ccd6518a6f603f8500N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
24KB

MD5
0e3cf2cdb6e1717b27339aa3ffcd4175

SHA1
c08664f1778318423ea36f0567ed4f26654f6770

SHA256
801d931dd56bb1c69f128fd746fc5e057d93c4412fb196940dddba376b7aca9f

SHA512
4a5cd6954c36351073948b7199b0bc9751013085e03d10797d425a0c90b935d4c98fd7cbece5d2623861dc3d406781483bee6c230d1a5db565962a74e2f6fba3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
33KB

MD5
1d863bfd53475de2b895ce6cd6bdd6f5

SHA1
1589951e0f80f5d875f53146134db0c1ee2ffae5

SHA256
d41804bc3e601df62859541b7f33ae77912fba90526ff3a0cd5fe634926e2e0d

SHA512
2a17ff7f0439ab5edbcaa4fbf7b2cfe1c2c818d9d269a067d42224d1bb832df17115c6368b98fd02f2ba904f9adb057e6b39a07ac27bc1b482dc4d63fd09e66e

Download Submit
memory/2660-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2660-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download