30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
Size

53KB
MD5

9085431cdad718cae63baa9bd9b99c15
SHA1

9b03902912865bbe345f9b390db3c163679e51c6
SHA256

30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959
SHA512

7e5cd4ed7c9b576685b061536c3ec15bff87fc8a44d381a902a3117f30b6cc9b97f3be4a2433ac060023a2ac943721ca29a35ac4b6a974a850640e90928d649e
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mdN:V7Zf/FAxTWoJJZENTNyl2Sm0mT

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3836) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0009000000012116-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2084-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUI.XML.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RTC.der.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe

C:\Users\Admin\AppData\Local\Temp\30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
"C:\Users\Admin\AppData\Local\Temp\30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
54KB

MD5
4890587ba88efca5aff12b39e721f64d

SHA1
1358a95be52e96c833f97dc3911dcf5982f00843

SHA256
903424e3f30e524723c1bf5b927ff27d57c851fa972319bd7fea42ffc48473a6

SHA512
166fc8df0158acca7ca14209e4c803c19e1d00e6afcfe732126c85d46b2aa59d43adbb92bb9b85e673bc68c2618004be701642a245e58546b2dd2a1180800a61

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
123dc1da42f7eb17384b014d3818bf21

SHA1
e10be08fd9ac24774690d5dc6b7d498538d36305

SHA256
f23d43a61d139bf295a5c6d47a4794369e164aa0cb1c998ed403523d3c8d8214

SHA512
2dfb772b2099cd0dbfda13fc13069d3145466aa33990343195541a32e1606ec5bed2be3377578b287df2e5b03cef57bccf5ec51c49d5f0a59587a4cc2140f8d7

Download Submit
memory/2084-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2084-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download