89c1010acd593876e1fc957acef2880d274467e3d7b6d989f5294d94aacf7cb8

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d29807f3ccf071ef3d8310d82984a20N.exe
Size

169KB
MD5

8d29807f3ccf071ef3d8310d82984a20
SHA1

5422598fc0257e640b4d51ed2840949c789d5d70
SHA256

89c1010acd593876e1fc957acef2880d274467e3d7b6d989f5294d94aacf7cb8
SHA512

0d68f8d8538d7c930cf18e1103e722227d0163f17b190268fbc557ed116697526650565fe816b40370b34d2db92eec8e2968b15449c41ddfadb2259f6debe68c
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8zx3Y3hx+fsio5UxKzWZ64+A8C4bwi:enaypQSo6VEio5Ua4N+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2827) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2808-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f1-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2808-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Noronha.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\bin\fxplugins.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d29807f3ccf071ef3d8310d82984a20N.exe

C:\Users\Admin\AppData\Local\Temp\8d29807f3ccf071ef3d8310d82984a20N.exe
"C:\Users\Admin\AppData\Local\Temp\8d29807f3ccf071ef3d8310d82984a20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
169KB

MD5
ee91e7b64c5678622521f5f11b2bf94b

SHA1
eead08b4db56af1c67ae068d3c3c624cc038e1ce

SHA256
0321e56ab82beaed5180a9d51104d8bc481703547e94d711118adcfc36a6dae0

SHA512
dad736dc779d2f13d5887bfba1ea7a003705f96b49ce424390e144007c05c513b0672fb63b8a6194b99d77014e80188ab608c13a43b515628915ed0bf2df8dc8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
178KB

MD5
1f4575670db113b4a7923a67376babff

SHA1
46ad4d9678e7bd3c645ea21e16616a637e2a17e9

SHA256
1268f4f92bc8b12ebef1e23fd527cb55eddf25ac3f145fff8a6a577aae90f955

SHA512
e78a37d7c3fd9313ca403f27ef56aa0b1bc612b6731ee52ab67bb88b9927e2014506d55ec1219810459a8f4804c5d6ee78a8a2050ea656aa0eef62daf2813998

Download Submit
memory/2808-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2808-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download