f0be1651f4737cb16378decfedb7c1cac1f8d27548f1c2f4430516f63f554e54

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
Size

77KB
MD5

e2ab8f8e3ffa1eb5c7ef90bd58f980c0
SHA1

611184473f3e9010bf99261f4ed10f5f832fd24c
SHA256

f0be1651f4737cb16378decfedb7c1cac1f8d27548f1c2f4430516f63f554e54
SHA512

606d3f44231fd9f2378ac009696a7140abbc69a5667155cb92591287c13638d073a00bbb47fc550c74a80fb8aa2b0427b03199d902073d4ff81a2d2475bc7c33
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZc:fnyiQSo7Zc

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2962) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2572-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000018710-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2572-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe

C:\Users\Admin\AppData\Local\Temp\e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
"C:\Users\Admin\AppData\Local\Temp\e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
77KB

MD5
3564df535d4c823e821635ad75d26982

SHA1
336b93c5bfbd1a4ff43eebeab23dba900be1b762

SHA256
b0da4f0b3642c112b8b667594d5bc3a2e25c851462e6cd19bbce57d12d80cd03

SHA512
ba4295cf9a030dd86f0b5f2a80ca8948a91727ec65bf03df3edfe722a97bcaeb726641b16d7cbb72e9094da74eaf7ab41a31a3729e5e3fd6f64c9286199b3d94

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
a3057eae7b757d66f247e581caac8640

SHA1
6570209b91a85060de1d36fe83773575b1c60818

SHA256
622b6fad46faf8fdd874137e1a8e27435b9c8735ddf619afe0e2fc7fa7c83820

SHA512
da0f803e8cd380980e98bc3304478c4f060554b814f75a2f604ea5d1cfe1684ff634fd77d483812cde0bcfb6340e67a825ebc4702475eb65d6b09a38581dc982

Download Submit
memory/2572-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2572-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download