a854a56a00eab640bba65486bc73403b719e5d2371148830f75618dcf598eb3b

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

297f06991298505dbcc2348a928c6cb0N.exe
Size

85KB
MD5

297f06991298505dbcc2348a928c6cb0
SHA1

f62466335dcb3461fb05231d6b1c702a1e31d26a
SHA256

a854a56a00eab640bba65486bc73403b719e5d2371148830f75618dcf598eb3b
SHA512

53ab788c3c2460654786bdfdb9dda8597639d89b0dcec87398db1a5c2624b8e1e5cc06fb97839259da7b0ee86a5d8c6d067352cdbd93ec52163b3f4dd5e7b476
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZf2XcqvcYUy4CYy4Cb:KQSo7Zf2XoCOCb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a00000001225e-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2916-72-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\bin\javaw.exe.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_zh_CN.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_zh_4.4.0.v20140623020002.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	297f06991298505dbcc2348a928c6cb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	297f06991298505dbcc2348a928c6cb0N.exe

C:\Users\Admin\AppData\Local\Temp\297f06991298505dbcc2348a928c6cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\297f06991298505dbcc2348a928c6cb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
86KB

MD5
3cae6315571be4445a4b83b8ea4cfcf2

SHA1
47276ab15a3ad0d6895b3e65bcf70cc1385a9392

SHA256
0ceaa89c49bb98e907568d19e5e05632e1d51d43267183d347243b1af73b8fa0

SHA512
f7144d00faa5b8cb18d603d62fc8ca85f48d6dd41d9d00cca008e3e4903212b7e15fa1080c33baae4eb519020430c73bd401d9c4c1eb89eda4e004d1dfd02550

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
fa28f6f532f0cded6d694becf78eb922

SHA1
48bc2481aadf4640ed5b1ed1e870c699c6584477

SHA256
b36367408627c38892404c139699bab91d8f1e9f3f90756459acc9da91d26013

SHA512
16205bd752d12a53ad89eac639d3b139db3378880fde22c8eb56bb4d1a1e1991949613b488487d74556045bd8309156d8c0708ac6a1d3725954f99fb599c7c99

Download Submit
memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2916-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download