0e16734ad6669cc91ef422d25fee005bd9c6883f05fdfda06052a211783a8772

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ed1f98c791b50eca0a42aba46bcd730N.exe
Size

1.0MB
MD5

7ed1f98c791b50eca0a42aba46bcd730
SHA1

d2b3be623c6c30a0f559540a3870d34613a7a717
SHA256

0e16734ad6669cc91ef422d25fee005bd9c6883f05fdfda06052a211783a8772
SHA512

187f73ee7d58551247f512c9a856369679db36125d712405ebe8c10ca832c989b5a17106b0e55e4ec06fcce54f2c9208bef2217e8080a0144312cc991c99e0b5
SSDEEP

6144:KNQ3RjTSP8ZeVdiZQjRBPCr8YC/htdCfiJYHSxKQjZHFR2W52z8urkL4vL/cAGF3:rj0wZQsE/hv28NeBbUjwG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (486) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2604-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/2604-62-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ed1f98c791b50eca0a42aba46bcd730N.exe

C:\Users\Admin\AppData\Local\Temp\7ed1f98c791b50eca0a42aba46bcd730N.exe
"C:\Users\Admin\AppData\Local\Temp\7ed1f98c791b50eca0a42aba46bcd730N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
1.0MB

MD5
c143cb8fd4dc05e422474ef07fa04640

SHA1
7612004604fdc6a5c681578b793700e44220690a

SHA256
88f1e3f6f02e59608c04a6b61291bfca191ed2dbec5d78fcb3030017aafb8f2d

SHA512
a5058c013da19ab6bf62b545a8aca03f2c75c6b3ac519a1e1ed8bb74bc2fa5bd2b5acbc499d136045faf60c2307cd16c06e39d7665c67724c10b11bae21627ad

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.1MB

MD5
fdb0c1c4d955992097df829148f30a64

SHA1
3e200a28a09d46d9f0262c3eae6c0184746c5252

SHA256
41de3a4bd47e3c2ef691b10aeb15dadc40201789849335257e76f8b71a09c84d

SHA512
235fe5dc38bf61c966e0ca955d88986007b04a262b8eb6539322955b698ca4d91882ddc8c0af1e30586c6e045d95722d7e0024555e6febb776522e4236abba32

Download Submit
memory/2604-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2604-62-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download