f93383a1164448e54550a5eb3e5a63a8a1de3076aaa4bec36c77ba85edd5226d

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cdf8db85a4a20fab05e018f860ef160N.exe
Size

52KB
MD5

6cdf8db85a4a20fab05e018f860ef160
SHA1

16b30a8eeb800e2922d306a438ea1b11cfa2e3e4
SHA256

f93383a1164448e54550a5eb3e5a63a8a1de3076aaa4bec36c77ba85edd5226d
SHA512

8aa1c9536c2df4c6237c8282fecb344aae7f6693a88784c4fa5e01bab1ca31e6e0c1ab99e996cfd588f0acb43de2086e8f48e49a5b7a2cbe5850151b828c67b2
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzC:CTWn1++PJHJXA/OsIZfzc3/Q8zxgWK

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2296-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2296-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\RemoveInvoke.pptm.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cdf8db85a4a20fab05e018f860ef160N.exe

C:\Users\Admin\AppData\Local\Temp\6cdf8db85a4a20fab05e018f860ef160N.exe
"C:\Users\Admin\AppData\Local\Temp\6cdf8db85a4a20fab05e018f860ef160N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
53KB

MD5
375374ba8584805c1367e88bbca0e000

SHA1
d152b5d07f4735e5b39a3e2ce91987d89459b5be

SHA256
62238ecfe19768679e65be7fc34cedfddb50ff322753b21bdffba70298be68a0

SHA512
53d1a274b0ff4ca93a46fd95a2dfd4f1ae558bc8a34eb6dde09839f733f02ff2f7811946ea24d02aff81a9d787c244a873c7f6da72ce97908ac85337956bf408

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
b97b18b57d089003305f8b58756bdfd7

SHA1
8dc14335bcec2657df16839e0e4bf8c4aecf5087

SHA256
f155abbea000496ac3b4f627fe26a13899798aa7037521f9496ff3fdeefcba93

SHA512
bf4c5061959489ed0de1b007dc435a11af7e085503459d0365f13fe8eec1369819bebb3e4d5835d3252d15e8fad85e69f05890ba90ea95ce2f003fd2f3378891

Download Submit
memory/2296-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2296-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download