73d21b283f7d5c6afaba3d6bab351a05f2f7475ad7ce40ffcf86a1b3d45f170c

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eafd3a5e1097a5607e56633594f5ae60N.exe
Size

52KB
MD5

eafd3a5e1097a5607e56633594f5ae60
SHA1

28353cbdec91091ab56168773155d2c8de0ea686
SHA256

73d21b283f7d5c6afaba3d6bab351a05f2f7475ad7ce40ffcf86a1b3d45f170c
SHA512

8174b0f21e9a9786187c101f2b163362e8962129fad5108691d19a700cacfc2a4e3aee8a83d8fe2e3bb526566f68d4b1d35d63a19a6dc6189ea5234a93645341
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyIHAJvHAJLMFX:V7Zf/FAxTWoJJZENTNy3DZj8Q

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000016d07-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2376-26-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	eafd3a5e1097a5607e56633594f5ae60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eafd3a5e1097a5607e56633594f5ae60N.exe

C:\Users\Admin\AppData\Local\Temp\eafd3a5e1097a5607e56633594f5ae60N.exe
"C:\Users\Admin\AppData\Local\Temp\eafd3a5e1097a5607e56633594f5ae60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
52KB

MD5
b7ff95c5d096718abd35d343df4c99ac

SHA1
83e943cb0f69c0d52205d42d325881d247a7e764

SHA256
cfb309a0678d61b81a7d166d8b8e8c7feb002354c31eb2282f63eb09918c2cd8

SHA512
f9ef8e7a7282ba0436ae95443c1e213585073a19b2601ae3e16e33170d1dc21dc29423f48efb50538096b7366454052df7278d4aff103076c2ab02b4315241d3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
61KB

MD5
110fc98415844dfe4bd40f7125bd08c8

SHA1
b5193d87ff7ae16b68f9e0896941b30d04c05505

SHA256
5bca2f2d30d098d9ff0eaab77171d2dcd0864d73fd7a90f80e4b270e523bfa7c

SHA512
bbcc80fbacc8e5bee9e91a43817fe3bab428a211130ebb53efbb52aca6582f47de3aca7b14a6fcf1d5f6eb013efb2e2681616a31502b62628423b2747da5226b

Download Submit
memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2376-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download