7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
Size

57KB
MD5

818b14559fca63282adcdfa8c9a2166d
SHA1

a3b9e25362c4b4d9af991268c55e6df9867a100c
SHA256

7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52
SHA512

4e4e9b7caa7018d7ece91930818e6ec1c705f80722d708f070a8d337e43b187a67fcdd4e98bc163bed2059dab497aec1f7f1779b9f209f6129e9d9a17bc99fac
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9HxAQwC:V7Zf/FAxTWoJJ7TAQwC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3746) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/2348-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingEngine.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\RSSFeeds.js.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe

C:\Users\Admin\AppData\Local\Temp\7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
"C:\Users\Admin\AppData\Local\Temp\7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
58KB

MD5
5e1214c01d2528bd6aedce23e12409c7

SHA1
3c51c6c9f76b5d3590a688cc60eb24621d07ebf2

SHA256
9d1890261d123a4c7591d6697bb37e492ff13adaa8f5f2e4e1050517976aa029

SHA512
244d1961dcca1a242ea1f5bea1f1c2283d6367ed5e84626436eb0356460453b47718680f5108a0584bcce09c2b2e3b140426c44485fe3a2c66fda654f930aaf1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
0f9eef46057139f2ee078ee7dc2e7777

SHA1
0a09a758d14017bc0bdfa05017c89323fc5b1c15

SHA256
c0235484f5b66160927a0ece88bc5048fff7a55423a0070411695331f2955e89

SHA512
1b972ec010172b86dc58f56eddd7618001d8911cc7b5d62f908229ac407e27772c9ef9bc6a1d42eb4687b52b47df83ef17a660ef1cdfbdcc87a845c942f7ba98

Download Submit
memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2348-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download