40f48cee16bd5ba11b181b7ed89d1bfc8f07a6dc4955f50aba4169f288d81e3b

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c852fbe35aceb8376723a393910a8780N.exe
Size

1.0MB
MD5

c852fbe35aceb8376723a393910a8780
SHA1

c50fd70deb32ac9aac0b05f8e11b5ff9647dbcdb
SHA256

40f48cee16bd5ba11b181b7ed89d1bfc8f07a6dc4955f50aba4169f288d81e3b
SHA512

0cbdc29e6d739cd4f95957adf13799cd6a74cc0d3be348ee6969a222b26da06f1f482abfdbdb0ab33dd9fd64875fb050a7f9e66c9b31dcc1ea19d71ebd894f2a
SSDEEP

1536:V7Zf/FAxTWoJJ7TiuHJ0l3IRNeWlo9+0hh8HpE+B0XuePAY0zs1u/ET:fny1N01IRNeWlo9+0hh8HzMu3zs1u/ET

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (561) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/3040-64-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	c852fbe35aceb8376723a393910a8780N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	c852fbe35aceb8376723a393910a8780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c852fbe35aceb8376723a393910a8780N.exe

C:\Users\Admin\AppData\Local\Temp\c852fbe35aceb8376723a393910a8780N.exe
"C:\Users\Admin\AppData\Local\Temp\c852fbe35aceb8376723a393910a8780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
1.0MB

MD5
110e90c41f2f8a21d23ad4a1312837c2

SHA1
b0f4184a7d6e583469153cfc03b640eefd9ed23e

SHA256
727a3b016e60a9717fb2bb1d64b1980fc8f17ec00fb3ee5ce6cf2c6d06a4da56

SHA512
92ed73cc9c4c6bff5feeeedeb748ccad1b5dd0efe6aa7d798932d08c5513a00d7e180aeb3c21f9ef98ea7b49e781e7000353f5e9e5e68ba66eef46ad62d2b722

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.1MB

MD5
55cb7e1493579775b314971b45aec269

SHA1
99603e56b74ec92e84c25ac3fe473c188b4d2e96

SHA256
c879b570d9fbf66e5e120a320129cd5ecece015ec403e83dc004dfd1179b0377

SHA512
3fc72c7b16e6525dc86ef1034e331ed84dde9e6576d0da36bad251a7bae6cb4df0ae0a1e59d14c959b89eb894111f54c1baeeaf08c83176f6eb087e616f8c8e1

Download Submit
memory/3040-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3040-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download