135e362be876da6c76a1edbd5d5278cf5058254213bcc2492911094f1adab481

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

734de762abadc837520cc099669471f0N.exe
Size

49KB
MD5

734de762abadc837520cc099669471f0
SHA1

3a77c67714593bdadb3b7b04c8b298b6f6db3868
SHA256

135e362be876da6c76a1edbd5d5278cf5058254213bcc2492911094f1adab481
SHA512

2c08e40c20e5ad08258e0aa1e5ff098922a26644edecb57f01df9310bde5d6489705d943d25b8c0e8e2839f2222cef7f3c478adb65dc929552e77bb3e2ecb415
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI97LjLNLjLGT3:V7Zf/FAxTWoJJ7T1vJvi

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2028-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/2028-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Mozilla Firefox\mozglue.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Algiers.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\AddImport.gif.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	734de762abadc837520cc099669471f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	734de762abadc837520cc099669471f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	734de762abadc837520cc099669471f0N.exe

C:\Users\Admin\AppData\Local\Temp\734de762abadc837520cc099669471f0N.exe
"C:\Users\Admin\AppData\Local\Temp\734de762abadc837520cc099669471f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
50KB

MD5
e2ee737e82e4e2c862dec66b41a6d71f

SHA1
dfb4c27cfe83a5a364526938ec30a5b6aa3e0cb6

SHA256
21d02ba595bd7edc28f423d9477efeb4d3eb9774f8a8b9e7ac71006c3ed8e231

SHA512
50887afd04840f97c6be2f8172b7aa8b4acaceba403c1f86d0f4bfc81c4b082ee2d9e0b2d67b5c8866c90070a635f4ce61a42bc46bbbfc8b44f817727c3d6f98

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
f59915b0301d08db83803aa68561ec56

SHA1
119cd563c3626a7d4ac041f37513b5edc993046e

SHA256
52e1f57741a1b24b6c51735a26bf2ffc9205b78be6fe4a23a82ba89ff97fed77

SHA512
89513ef3f58923d1c380542b2e1ebdee0780e35899f7d54a920388738c0c871e8fdb7d4634b1573cd0a99008dc73344df215ade4d7f3a6929a67efbe4d6235d6

Download Submit
memory/2028-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2028-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download