8e3ed2ebca4cac9db345dbfd0dd2ddf49a26c5e8a4b4c2f38aaf445252aca742

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bad59e53bbb37d537e7ccd8edb6a1700N.exe
Size

85KB
MD5

bad59e53bbb37d537e7ccd8edb6a1700
SHA1

c59346a8d2b1cf98fe97c07fb0c8d3a59b45deae
SHA256

8e3ed2ebca4cac9db345dbfd0dd2ddf49a26c5e8a4b4c2f38aaf445252aca742
SHA512

9bb0e2da54202b48108864bf1620ce766663419c6628556a456e5a33ef3b660fbff821df9d7c5ca76c9fb156238457944ac40c0212804a1bb0cc48a968a1fba5
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2IqS4S/:fnyiQSoDuXuv3PJ/

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/836-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f1-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/836-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	bad59e53bbb37d537e7ccd8edb6a1700N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bad59e53bbb37d537e7ccd8edb6a1700N.exe

C:\Users\Admin\AppData\Local\Temp\bad59e53bbb37d537e7ccd8edb6a1700N.exe
"C:\Users\Admin\AppData\Local\Temp\bad59e53bbb37d537e7ccd8edb6a1700N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
85KB

MD5
3c36b550af3afb6697039e187d9aba91

SHA1
89824c10e9000fee51d183100a8b088fc6efe0c0

SHA256
27501b9d89faed1a3258ee12ab2a042fa3e62c4f43875aa6cf5c4b0be184d81a

SHA512
a29cf26bbf3bbb41273503d257852b67a42f62d1bcf369375943a04dce424e929b8b771bf8cb63e2678edf77a966b57a009fbfc1f9a2657a0aa7c6e50edc2b50

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
77afbddd861a621d2bb777ffa2093c4a

SHA1
ce5df936e8de362f7d4007612500e518731b35a7

SHA256
ee6b6b5e0a1831a02b5f6e28ef440ec377535c80dfb8222662bd5f631b064795

SHA512
6c3f766449b2f0705e90a1b423328ad8d9d48715ece56734178eb1adab972470ad161656dde92389de79f9c907c1e55aff87c0b76aabc4c2a80409c91c8f6836

Download Submit
memory/836-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/836-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download