563feec1ea41b72a88526608b141a1e3a8bcb4386d88267e56813ae1af85cd40

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a25deead50b474200231c874f882ae0N.exe
Size

90KB
MD5

6a25deead50b474200231c874f882ae0
SHA1

d410b5230277a716b652bcc770f3bf3dcfd79f07
SHA256

563feec1ea41b72a88526608b141a1e3a8bcb4386d88267e56813ae1af85cd40
SHA512

212c08e70fec1cd865441e0da22d6948e76437134c4f9a73d1ce427f9df0181869683eb73373e07bf8dbbf27cc62e7166c179340d402f6cc6b8e9255eddb3479
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGh:fnyiQSohsUsUKJ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2910) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/1996-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\SendHide.sys.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	6a25deead50b474200231c874f882ae0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	6a25deead50b474200231c874f882ae0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a25deead50b474200231c874f882ae0N.exe

C:\Users\Admin\AppData\Local\Temp\6a25deead50b474200231c874f882ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\6a25deead50b474200231c874f882ae0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
90KB

MD5
12b7abad215bf060884ae9e9d1a31e44

SHA1
df5ce7e40b501f71d6aceb3807dfe3bb31293e42

SHA256
630aafd5a5c19a1b0f5af663d7547c2752fca6ce4058b85cad54d5d0ef7a185a

SHA512
fe09be93295f76f1b6f96097745a65ac8756c082a1216d70b810ae7b97fc1edb85a29491a5b1da48bc0379179809025c48fca7d228c771d81e104280855c7d61

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
15cef91bc73517278fb8102d80fe97fa

SHA1
11f18dabd56b7ca8d8ba697b0d7ca9c043c36ad7

SHA256
817d0c9bcccda98c51d1f8d846e03c695ea5a3a19e494dd2d911eca4abebc09f

SHA512
98a7009c863614e6a3044ba1296b6e4e368d397449296b995d2784a41ae7177d5018faba20852e51b016eecf38bc34504ba2aa570280d1068e3a98e64d03dc76

Download Submit
memory/1996-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1996-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download