712aed018c59ac7b053b6dd4c81600ad4bf743f193020c03d59a434d75109cc9

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91df8df4b130d9416c8538de8d14cd20N.exe
Size

831KB
MD5

91df8df4b130d9416c8538de8d14cd20
SHA1

025de8329f365f74820097cbc20bf616bd21ab00
SHA256

712aed018c59ac7b053b6dd4c81600ad4bf743f193020c03d59a434d75109cc9
SHA512

d2021c162f9511228896ec552658ffca9ef7fb7c2a044a45297ff3fee01901f562b93ed1289175bdb910e2a5a1234c356c0e3b7246b8c50bddc4ac7f062e467f
SSDEEP

24576:3hV56pKEBhC8iVXrWgqAipHsceoiBX3X+W+s:RV5UPmZrAHfiBHX+WZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/3028-64-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-iio.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\AssertUnregister.mpeg3.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91df8df4b130d9416c8538de8d14cd20N.exe

C:\Users\Admin\AppData\Local\Temp\91df8df4b130d9416c8538de8d14cd20N.exe
"C:\Users\Admin\AppData\Local\Temp\91df8df4b130d9416c8538de8d14cd20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
831KB

MD5
79e75447e800343e64f14430948172a8

SHA1
cf6eef65a28c3d02a25a7c7228b65d342d4df654

SHA256
ae524b6a907add9f0d7934ba3afad14010938a145a09f2eb0431371992d48a5f

SHA512
5d5f9f9c58be4e7394e20f2e82cdcc2407533639f7a2b3155e14e7ab6cdf80492b10efb9319a0101a6dcbbd226d916038c8bb48e334cbb669a3f0ac74edb2a49

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
840KB

MD5
6bc556418fe9aed9d37e5cc6fa8784ee

SHA1
5bfe0eeff57f6b876410a180b7664be2d433eeec

SHA256
562256262453b75d4a7da0d1550db3d83e17c5a4cb1c9065ef9d2fb3ae9d290a

SHA512
4879cdc85958142dc8c987e705d23e45875888dc15f09bbcd6d53f0b7963aac0e6879bcb87c009ed6a5d22cee0c22b2a5368128301d3ff78b2c9e3a211f575c9

Download Submit
memory/3028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3028-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download