55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
Size

40KB
MD5

57b0f829dfeb805235971b69abb91b3a
SHA1

766e7e15584ee7ee615486d340a2da8f79ba95b0
SHA256

55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b
SHA512

9058143a1982d1699e52033531a5d4dafdd4f4df10a696e885f8226ccfc489ea9057b9e29ef2289105eb4ba9bb5de5b9e680e6e1ffbd101edc6eebf87a2d5291
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54w3+c+1Zf:CTW7JJZENTBWv36cZf

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3775) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012274-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/1368-72-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\slideShow.css.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe

C:\Users\Admin\AppData\Local\Temp\55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe
"C:\Users\Admin\AppData\Local\Temp\55690299b8ea94839112f6c864506f618c264eaf33252b0102cb619030e01e0b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
40KB

MD5
d94365fcf5c293e85a2f2d662c3a5459

SHA1
9b5c2b6fee9486da92fcc5305faca6e69f4a4853

SHA256
105590bcc64415a5300d3cff3ad90417464e43d60986dc3f51e46638c16a4053

SHA512
9f4021f2a2bd18d33c7d807e795aff365cfababfd335db6be0521a9ed0ee3ffb023d2687bab89fbbd18659445647d42e1649b1baf1771f57b86c5f7728483806

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
f0db9e20772c79d1c940e4f4b565946a

SHA1
e743610f95107f82460c572d99444d2b6a4fbd68

SHA256
e738ac7db0a5f20a76c5a156cafbc4edebcbdf53b03580f09515f613e1d750b7

SHA512
35709f62b54bd1366ee9b7b216276b648d92ee8bfcef63a454eaaa3da1589c3831423d1361f2c306c733e94c4b171c4990fe93cd5afa7d3617bd9e874de7b207

Download Submit
memory/1368-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1368-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download