5f9026c275801c1a19633e009a8940cc6ff667a13ccb2725c357266c90b28437

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84ecf03159e665094b40610db1a74a10N.exe
Size

25KB
MD5

84ecf03159e665094b40610db1a74a10
SHA1

2902da62e29029667c16c274340752345900033e
SHA256

5f9026c275801c1a19633e009a8940cc6ff667a13ccb2725c357266c90b28437
SHA512

9de73755ebcdc2d9fde2b1bf48507420debe689fe6166658a908c6e3f3bf806d6d4959b53022b6d6f8a442e4a10355efbc2082fb95fc687996143a14f4f5a8fe
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9mHJGvBJJGvBM:CTW7JJ7TEHJGvBJJGvBM

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1960-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/1960-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\fr-FR\Solitaire.exe.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	84ecf03159e665094b40610db1a74a10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84ecf03159e665094b40610db1a74a10N.exe

C:\Users\Admin\AppData\Local\Temp\84ecf03159e665094b40610db1a74a10N.exe
"C:\Users\Admin\AppData\Local\Temp\84ecf03159e665094b40610db1a74a10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
25KB

MD5
6dc61a796f0386488a31a348c1296c42

SHA1
e4586d2bf7071f6f92d7e174b3b7c3172702b588

SHA256
dd1fc450d5cf19d858000274f2cef2649685993217fe3948395dbc21cb10c161

SHA512
17bbba19d506307a4a7fdc733ad96d5453f782c11f43481dda0475e85b9ca68652eeec015879a1d26334d6d7f3a395d32925da9de83e9925cb16bc36501e3a24

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
34KB

MD5
5c25a817748ae1959386d134b7d82f80

SHA1
7cebd732a4a7185c41a6bdb897199683ba358a7b

SHA256
a8c01e3e4732c45ab6bd217359487ab6b3da4351e1be5cf960ac2cf4d26a3bf6

SHA512
abe33ea6f89cb14331b4a792e222c5a8b3676bd5ddb3757616fc90867587cfd41dae4fafc082c3abe545023ccca4467cd118c8fc66f271a5fbb303cb6fc7fb98

Download Submit
memory/1960-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1960-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download