4071a589a589fb9512f00e48571d69e4f0c292cd090d16d877692f8e28580476

Analysis

max time kernel
120s
max time network
15s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

467d087f5799e5bf984c8f6604f93ea0N.exe
Size

22KB
MD5

467d087f5799e5bf984c8f6604f93ea0
SHA1

3b3be17d1eb9f5afbe01688b7c2e1e4b9b6f539e
SHA256

4071a589a589fb9512f00e48571d69e4f0c292cd090d16d877692f8e28580476
SHA512

91dd17c582ca1a1cb816778802cc493e61a6d853e597ad8be028de07ab65276ae7e432263318e402796c1c1411b03c7d50014c0e24a6b4dce148657db94109d7
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9T:kBT37CPKKdJJ1EXBwzEXBwdcMcI9T

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2952-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0009000000012118-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/2952-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\ApproveWait.html.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx264_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	467d087f5799e5bf984c8f6604f93ea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	467d087f5799e5bf984c8f6604f93ea0N.exe

C:\Users\Admin\AppData\Local\Temp\467d087f5799e5bf984c8f6604f93ea0N.exe
"C:\Users\Admin\AppData\Local\Temp\467d087f5799e5bf984c8f6604f93ea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
23KB

MD5
1e8540a072691851d311968400d78942

SHA1
315503c6a1b5100a42b814b25f7f941a34027ca4

SHA256
b1675a944ca4d57ea015997125d8218bc5a273dd43adb3824f1ead34c65273a6

SHA512
bb1ffb8cf151abce6818f012dd37b905b4236716e508a4948a6ed5ac7f5e6af82ae94f7461e45cf19f1d1138bdcc4bfa50168297841174d7cdd07e4d15755f79

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
32KB

MD5
490552e9eb7d497246b37bb189e8ca96

SHA1
a016ca01c8b066ce1a25e57dbcdbcf537cad050d

SHA256
8f5ab182f62ea9e9e74f7220bfde401838cb858dfd1a3103836edf6e82711637

SHA512
4bffec0fb2ce29586c5e9f163d88bd207b03bbf12ba2158a9ae1895600ab728d42ccf43ff4448993a85cdb5db2969ac1549d0397a101970e3521755e5ee602b7

Download Submit
memory/2952-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2952-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download