300abd09f486e063434fbaa881738da0a5fbcf14c1d70e1dd469e0f78848091a

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f7390f9e47ee1a86c1886e404183200N.exe
Size

56KB
MD5

5f7390f9e47ee1a86c1886e404183200
SHA1

0bd77e5abd375380ccafabacc6b9d4ec10d89ea6
SHA256

300abd09f486e063434fbaa881738da0a5fbcf14c1d70e1dd469e0f78848091a
SHA512

fbf745f36221aa7a435c34a413372700930d843858f7b685ece95a5120d8a8fdaa27e557b8fd5be1d1eca480102f45dfc4b0542276e55d98c0be3b2c646a01c9
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIR:CTWn1++PJHJXA/OsIZfzc3/Q8IZT2pO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3374) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1012-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001224f-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/1012-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationBuildTasks.resources.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\vlc.mo.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	5f7390f9e47ee1a86c1886e404183200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	5f7390f9e47ee1a86c1886e404183200N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5f7390f9e47ee1a86c1886e404183200N.exe

C:\Users\Admin\AppData\Local\Temp\5f7390f9e47ee1a86c1886e404183200N.exe
"C:\Users\Admin\AppData\Local\Temp\5f7390f9e47ee1a86c1886e404183200N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
57KB

MD5
0ce481e24de590c370e4f1a99afd6a4d

SHA1
e0441b68f9d46fee0031cb41e01c4ea0afaf45a8

SHA256
7187d6bde538e76bd97f1aa336c515e7513d0700ea5570be0a2d57e6acf7b3b1

SHA512
d6f5d36d8de106717da3c9ce68b3a1b26269d7c0d98d817c44775422f2ca5c8380a609673627d00a63a7111da8b27af50d98af7388215277141af39b23810340

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
5abb3b6c75bfdaf5040f9fa257f10a21

SHA1
848f68eb6acc6d25f9be312d3b9513471d778fb9

SHA256
89c1d79fd46ca6cec32b4c3df834ba1b604d77ed417389df1e28fdf9c87607b8

SHA512
2dcb6aab51fcebf67e7ba630a2434b5c06acfaa71e5b6599f8d105fe07ff420407d190ca5402bb0532b1b90599eeac5fd59201e86394b290fa894da5e26ba13d

Download Submit
memory/1012-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1012-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download