5201352ae6d7cfdf7416b37bce794121e0452d35cbaa45ca4696bf2b5650ce90

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58b9146593a3419650fe6d31336a21c0N.exe
Size

76KB
MD5

58b9146593a3419650fe6d31336a21c0
SHA1

2f28257656d1817cc1436026699c95acb675233a
SHA256

5201352ae6d7cfdf7416b37bce794121e0452d35cbaa45ca4696bf2b5650ce90
SHA512

f85a4ac5face8d40c627b99abf1eada1e5ef4319af5aa940c502cb09f4bb1ffa4982b12c02e06548ecfd81d88ed2d9ff67cc7228e0b5e82c226313242e9b0b89
SSDEEP

1536:V7Zf/FAxTWoJJ7TVTW7JJ7TXEvBnHHwTVEvBnHHwTd:fny1K7T3

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1984-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	58b9146593a3419650fe6d31336a21c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58b9146593a3419650fe6d31336a21c0N.exe

C:\Users\Admin\AppData\Local\Temp\58b9146593a3419650fe6d31336a21c0N.exe
"C:\Users\Admin\AppData\Local\Temp\58b9146593a3419650fe6d31336a21c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
76KB

MD5
d188d1b9544345aeec6371b2e416940c

SHA1
579227459075cbafd58980c1b85df175792128e3

SHA256
ec7a8b19234cdb634d84812549e65679d6fc542f1781d739ec7060808aaf5dbd

SHA512
6e1a6dad0648bfa8003b6aeb3b761c67429473283655b789af29696708e3ccaa978487e0a25fd351d6ad33b83d5448edc1b1b2593a6ff4afcbbddf75695500a9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
8c8bd9c623241a74bd1480623e6e8997

SHA1
56103aacf31f7c901f3b8eb47e653fe58aab5cb5

SHA256
31940063aa1a1daa6002d86eceb4ae024e1aef411c80f8e561fdc23d675c6961

SHA512
542a998ae058d7a5cbc8f7fe723afe81563beaa6f24f245714c10152f83cd1c75a2d8ee47821aa688d4f1cd9d52a1f2528201f0f44c19bd5a4e61cf890f1ce21

Download Submit
memory/1984-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1984-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download