bdec09dc899014e66512df8f88324203fb099da704390eabd9c7a94366632983

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
Size

37KB
MD5

9e8139c4cc153628d4dd0f38f0e4ebc0
SHA1

04f7c9fc7056a04cd9bfee1b6c3bd3e311c4786e
SHA256

bdec09dc899014e66512df8f88324203fb099da704390eabd9c7a94366632983
SHA512

828a3ca3593b34c658e1bd20bd9fc4ae0590a8117c034b25493e419702553a045b9e0471e08793dfee8ac29de1b41673e78ee7bac6485f0b946521f65bfb67c3
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54wjMWMO:CTW7JJZENTBWv36mhO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1720-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012119-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/1720-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.tmp	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9e8139c4cc153628d4dd0f38f0e4ebc0N.exe

C:\Users\Admin\AppData\Local\Temp\9e8139c4cc153628d4dd0f38f0e4ebc0N.exe
"C:\Users\Admin\AppData\Local\Temp\9e8139c4cc153628d4dd0f38f0e4ebc0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
38KB

MD5
15937a0cc288a1213daf620d35a74f8b

SHA1
47b691a5263339fed8b56591f6c179e4f3209a63

SHA256
5daa6d3ad6d42d5d0cb8d863ad117eb6dd4a658277ac2862ffb845b38a707f21

SHA512
602b7e71b40bcdedc39ac9f75ea16d1a839ad55359d3b0dc12e2596017a0217544d9a86ffa29fb3a8a30bf4b53747c5489bb1a812a2a4b1d7efad619eb93f076

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
1c2e603e1723f7adb1e3a5fad59dbb92

SHA1
bdc50bbbc113c9b0d7140b79a5c70daec940e357

SHA256
f8e472a4d19fe33ba860ebcda90f7ef433399b2009ab4d57a56b6bf567ecf4ff

SHA512
dbb36ed82228bc2d535c1ed65aba4fd90c99d9d366642437c94c6e4519cb38c70c2debb028a7a16b5799be53e46b0a6be8a466b12f219da394e4207627fbd68f

Download Submit
memory/1720-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1720-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download