a25ecdca7302d83505ad6af9c04a9f7df7a9ff87f7dcedd986f6bb10409acc7a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0248b1357293c113579c511352e9fed0N.exe
Size

81KB
MD5

0248b1357293c113579c511352e9fed0
SHA1

3af92c3e0a8c9ef57c6c385fcdc97d3f9eebe0e1
SHA256

a25ecdca7302d83505ad6af9c04a9f7df7a9ff87f7dcedd986f6bb10409acc7a
SHA512

39959cf42e94033e2c6affb5c4816c8f8e34e36ccdd4434b6a6a39eeb4f7af8f9c8b0941a1cff3e2c0a535c8332e06d1935d42e02723b92a9be390dd4b322604
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5AQG:fnyiQSox5AQG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3683) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2748-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-2.dat	upx
behavioral1/files/0x000f00000001045a-6.dat	upx
behavioral1/memory/2748-72-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\ReadInvoke.cab.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\slideShow.css.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\settings.js.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\CopyUndo.raw.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\js\cpu.js.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	0248b1357293c113579c511352e9fed0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	0248b1357293c113579c511352e9fed0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0248b1357293c113579c511352e9fed0N.exe

C:\Users\Admin\AppData\Local\Temp\0248b1357293c113579c511352e9fed0N.exe
"C:\Users\Admin\AppData\Local\Temp\0248b1357293c113579c511352e9fed0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
81KB

MD5
6c71cf1423704c97a60a459a0816ab12

SHA1
775b45f1d25d5b469a9e252c414e00c9069f709a

SHA256
51dd2c5e189f949f38da95c747c04a6e9e01b8e166e8d131f03f7651666c7d13

SHA512
03d6805b440a4b379b74d3de486c8c16f98baae2e0b5acfc86e8d97c0ca733cd22f74160390ab7ed1f6b9e8d2c742ae1f8240c7f8566bc3063261c15c5e51aab

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
a16536f134a4876e9857f5a7d69920cf

SHA1
b7feade4f1da95d9fe2b5451a052cfdbc59d228d

SHA256
0f6b9cda87f406e08b6a483ec3ae917ea71469127d0fad1b0eb1c7891fdc8e16

SHA512
601a49cfbdb0cfe3614f517965c2d60cd39a977e82186b5eaa3b14e18d6b297ac0eec26a7841bc6b9239f67785809adc6143705b5f1b9573b5ea4b6f29f0cab5

Download Submit
memory/2748-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2748-72-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download