14adb098236e0fb6fda030a451937296f8a64997021dcb68eb03ee6f1496e1ee

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee323817db18eebc776883f2532dcbd0N.exe
Size

70KB
MD5

ee323817db18eebc776883f2532dcbd0
SHA1

dd6285510ccf9be2e3c37f10ad09e1e1a6ad349a
SHA256

14adb098236e0fb6fda030a451937296f8a64997021dcb68eb03ee6f1496e1ee
SHA512

3e95ee4e53c87f0d2e070c4de3888a5dcd17afbf349b3599a4d40a26e857d11138a2249a5b3d384db927136efb30640b35468011d7f0a2f20f16c77cb62b0f3b
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCm:enaypQSoskx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3248) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2340-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/2340-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	ee323817db18eebc776883f2532dcbd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee323817db18eebc776883f2532dcbd0N.exe

C:\Users\Admin\AppData\Local\Temp\ee323817db18eebc776883f2532dcbd0N.exe
"C:\Users\Admin\AppData\Local\Temp\ee323817db18eebc776883f2532dcbd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
71KB

MD5
6c365808a0e36440b73f4ce180e16f61

SHA1
cc38d3c3d9485d42fc66ec4369d32e5afd1979b4

SHA256
a999def3d741c3352ed00bc9712f8233629a15e16737e6eb9d8ddb35ded73a26

SHA512
d8b339d92722ff27e9d71601c0e767d70e6323194c492a3a01b41125072e1f7ce9c4f9ac25c6d45b28ef0ad1d7bcf757d07e994963afd5c8bd50dbb26220a89d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
e832124592cb440d6eece2d69d903510

SHA1
65eb46a1a356875083128d78af80b362d77671a8

SHA256
34c60d01e4bc89067befcd2c289b0abf5be44cb07b4ba6777e453fdc920cfe52

SHA512
d5d2f2bcdafc2feb98b92a2516742be8679a83f6a2da6131d6281937e2a0f5b8c378006accf30f64cc3f141ed41912d3aa47844635ddf94e7d28d9bed8296a00

Download Submit
memory/2340-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2340-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download