87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
Size

26KB
MD5

0c206f3f112ccf225bedb2b062515a32
SHA1

70d78b640a89d58c358e79cfae32e3d93b64c627
SHA256

87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c
SHA512

49ae76f6a2b0b72088249033d0000db1f13b438ff05c2136918c33c3b48c0f0ea734e9adec9783f69635f7ee702edf7f41b2b9cecd7d27ac0292867b3afb7c4e
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJ6:CTW7JJ7TPUN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4066) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2096-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012260-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/2096-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSSOAP30.DLL.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\BASMLA.XSL.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Windows Journal\InkSeg.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\psfont.properties.ja.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\micaut.dll.mui.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe

C:\Users\Admin\AppData\Local\Temp\87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe
"C:\Users\Admin\AppData\Local\Temp\87ff90a1b3c490f79fb8d1a915730c99a1e5059a9c09147e1ad93182113c524c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
26KB

MD5
f030330efcde4ad9cddbaa003b053569

SHA1
68699ea50e13a48793d72c4613085bf1dd7855ca

SHA256
738beca37a141b7c7ca2243b6a328e74b8e20cc2af951072d8788da87b116e2a

SHA512
e271eb9693d30ad972bba4e396066acb7f63c99cf84a2f12cfef4ed1f4731eae5491186a85cefb5744eafb102c93349418302a79c6d18d81b11041e52db8f4a0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
35KB

MD5
b2fd3cfb1bb875acef2d82b5122b90ee

SHA1
fa2ea57709e631aa8297220bb604906858f3ed17

SHA256
6eb53e3442bacb982e45246b5df76d6609b58668555663a6adfc884604e4983b

SHA512
db1e7be28dd5bc92576d3ce126c174bf66d4e88cc7700acb60690d40b215feda4db8f71807bf34d4bbc305a1fb23c29785f9bf0498e8e860bd14c648eaa3dd71

Download Submit
memory/2096-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2096-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download