08ce10f82f8e54df7c4541cf578acc84d3238f497454aa747fe654fb6c095b20

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f56ec2f8153c1fd02a143aebf2f89d0N.exe
Size

36KB
MD5

8f56ec2f8153c1fd02a143aebf2f89d0
SHA1

a193036572879579bc167fea39e17dda5e1bb563
SHA256

08ce10f82f8e54df7c4541cf578acc84d3238f497454aa747fe654fb6c095b20
SHA512

c08b50fb26ac1bf9a386fd65b4f7854b4ddfeff56c3d529d4fedc277868eff058a1427544372210c32f30af85c893a0e74c735101a81f34a90df242aa29cf17a
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ59ADJsRRYstRYsJ:CTW7JJZENTNyoKIKMRRYstRYsJ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3234) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1812-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0010000000012265-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/1812-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Easter.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	8f56ec2f8153c1fd02a143aebf2f89d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f56ec2f8153c1fd02a143aebf2f89d0N.exe

C:\Users\Admin\AppData\Local\Temp\8f56ec2f8153c1fd02a143aebf2f89d0N.exe
"C:\Users\Admin\AppData\Local\Temp\8f56ec2f8153c1fd02a143aebf2f89d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
36KB

MD5
7ddfd5a55786376424d5629df782fd30

SHA1
c81f4f9dad85e1a26652c332d2b332682e91af11

SHA256
b479446c96724f0fcb974c459c16596a294e4b934cef4000fb932478af76fef4

SHA512
9d064841ef55e9fd34457f2b6d8efcefea4d5a8f07b7bdcd902bda9788c4c690cc8e0e0d1099f80004775bc73bb1b68a13b93e9a9aa779511cd296998e072060

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
288f7d0e79ca9c5b0f1c0940f2b77c01

SHA1
814249b05faf4b951509d13c834ee622a33d4970

SHA256
bb4d951dae08294e91ef6a22f8c41e6b7ab95e6434b073eb2f514a90deb6c2fb

SHA512
a0aa245de076518599459daecf8bac65a84a3be1bc7497a167b69a353dab8abfdb6a170d2ca11892ae1400e4a8e0f766a924ea2a2b9eb525dba284257720e845

Download Submit
memory/1812-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1812-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download