96762f20e5f6bff295854ba1bf2d7352014e4133a4cbb19785e121f25209139b

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19b21eb0498202fb0cf423fe8e386390N.exe
Size

35KB
MD5

19b21eb0498202fb0cf423fe8e386390
SHA1

9db058f74b504cd59d2b00b072dacbb7b78a07c5
SHA256

96762f20e5f6bff295854ba1bf2d7352014e4133a4cbb19785e121f25209139b
SHA512

2067ac0d1a4e4678f3cd9a1638a9fcc3cf0bfc87c696cefd619682e38c5354cd63658277f5639bfb531402787da9076aa4cb5d6f0702d481dcdbc4ebf887ed96
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mdGRG+LeoVERZLeoVEO:CTW7JJZENTNyl2Sm0mPW0

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2548-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jre7\lib\resources.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net_1.2.200.v20140124-2013.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	19b21eb0498202fb0cf423fe8e386390N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	19b21eb0498202fb0cf423fe8e386390N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	19b21eb0498202fb0cf423fe8e386390N.exe

C:\Users\Admin\AppData\Local\Temp\19b21eb0498202fb0cf423fe8e386390N.exe
"C:\Users\Admin\AppData\Local\Temp\19b21eb0498202fb0cf423fe8e386390N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
35KB

MD5
785e99749018a20d3e45826b8fbb26d2

SHA1
bcf1e5645b68a20df5e78e38c9cb1f4acd7df1ec

SHA256
0fb3f7c1b35347a89ea3c6d1f0fad2dbf43d2e6c5a4b56d8a6cff7caf6f1d15d

SHA512
db98c51add0b97f9e46ef068c257382f5b44103af69450451676f7737397008675524a72862fd9b7626a36b2875d49a399b7ea52b8d277d49c2b6e080e859093

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
3d411de3bfcb0215b1acb1bce96069f0

SHA1
aa53e1dd0ec2f754fa394752ea68e6c2c7759489

SHA256
d805b6077513e61ac72b8a80a9a7fd297887eab8edf38358220086526554b262

SHA512
9946b5bc05cda25dfe3aa539b4ed758ad4a86d0d962d0360791c466a5a866ddff72c92ca41813d9236d6df9ed3ffa6ed97c06120b53337fa73b535ed80c2bc57

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2548-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download