1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
Size

87KB
MD5

b263c48ccf9e48032c92a0178e08dfe9
SHA1

1bc0ec7c92b23472e509538fe0800494b8385c46
SHA256

1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662
SHA512

2d835652931e2abf4ab4dd1047cf9633ecba3c42a2a8f48ec97fae7bb1173632831635b66c617e63d8c38bb89ba6a11b244f00cf212b130f715bc421a3772207
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rF:V7Zf/FAxTWoFTWpJY6IY6Q

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3537) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/files/0x000900000001225f-2.dat	upx
behavioral1/memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/2360-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\settings.css.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\settings.css.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\cpu.js.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Full.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnetwk.exe.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\bin\keytool.exe.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\clock.html.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Media Player\ja-JP\mpvis.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe

C:\Users\Admin\AppData\Local\Temp\1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
"C:\Users\Admin\AppData\Local\Temp\1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
87KB

MD5
3ad0dfb2d833cd1ffbf2c19d2ba18726

SHA1
cdff2b86e96a55dc97dc199434f2f3c0339aac18

SHA256
432fc855351d2a8237abbf297f1d0e3dddf081fc6c122eead2d0e792b77fe239

SHA512
2b01277cb14a82a6c6181abd217b8df62c894302450b19783d4a141a01a36c687e20c8a80de624e04a3682c9e2201b5c4f9db5edfa335285df03073795afb2f2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
8a412075288f53e3cd6ec07906b10f09

SHA1
1ca2d75c73977ce39c7b53fb11bd717d5785bf63

SHA256
7a03e70ff7fd0702845924bb48fe0e1e592c3347dfc335348cb2bbae29f3e277

SHA512
a369bf181feacfc7ccad12105c7d48127b384073e88b7a1ffffbad2398794367e98a5eec71d3c4337b791d0f622d7c18385e0d27bda3765184aea97845f79017

Download Submit
memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2360-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download