abe700a4c3c1735a64c6cfd72c472ce14f4bec392b84bcc90f5105b334975dfd

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

694cf5aa36bac22cd00c5b50983ba060N.exe
Size

24KB
MD5

694cf5aa36bac22cd00c5b50983ba060
SHA1

94189fe117dcbfa4f3c911beb0842a7558d4923a
SHA256

abe700a4c3c1735a64c6cfd72c472ce14f4bec392b84bcc90f5105b334975dfd
SHA512

dad0bde8e249facbba198e2755d9e30fc078bf13c4d17823c372553567377939c73d7a7801fd6bc2e2956a03cec90b269b3aa0fccc57ddaa4cd30ddca698d758
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9qoIlOiJfoIlOiJY:CTW7JJ7Tk1a

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3417) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1496-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1496-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\TestAssert.scf.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\plugin.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	694cf5aa36bac22cd00c5b50983ba060N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	694cf5aa36bac22cd00c5b50983ba060N.exe

C:\Users\Admin\AppData\Local\Temp\694cf5aa36bac22cd00c5b50983ba060N.exe
"C:\Users\Admin\AppData\Local\Temp\694cf5aa36bac22cd00c5b50983ba060N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
24KB

MD5
644393b778de470ed2881f9b7286749b

SHA1
dbb22b3b0038df0acf06c760e8f37ba443cf5ef7

SHA256
7cadb34c00c1bd57a1c1f865754111aa5ce7f92f8573776cdac4af25c5781430

SHA512
e482a2dbabd6e2724625134eda3002ede188387ca57aae1efe5b126d08a86f5521ccffc1cc07c8a3cf4e21fb085e84b72e745401ef4a945c398eaeeac58ffcda

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
33KB

MD5
5f4c19e2f5a6caabdc5f711aa2a70247

SHA1
f68b819bfba49b3f12ee6f0046961c900029f88e

SHA256
151bb368e2afc6d290ee886c80463a7e5ef6021fb47a5cd42562bd1fdb9cde0a

SHA512
36a1fb82198c0d8c0a602fc91d1d2185465776daa2e5540661aefeb16da740a5abfe7b0de4f29e820ce3e5611f55c1b59f44e303da11abbfe043ffcf26fdb9b5

Download Submit
memory/1496-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1496-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download