036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
Size

62KB
MD5

6a4e99b4c796cebc58774b73b058c6dd
SHA1

00d39cab6698f20692325392f80859d9e700a237
SHA256

036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f
SHA512

0b8a411c4c138b0fe2b805fc74e0978c228b1083fdb2d5a28af26febbc9b95c53226bba4eaa7fda0a6c1991e47d3eeded23015d9652b9b0caf0c8412655e5b88
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiRgNAgNS1:V7Zf/FAxTWoJJ7TTQoQSHSORKn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3751) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1596-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0004000000011ba2-2.dat	upx
behavioral1/files/0x0002000000010489-6.dat	upx
behavioral1/memory/1596-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\VLSub.luac.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\MoveTrace.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\settings.css.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe

C:\Users\Admin\AppData\Local\Temp\036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
"C:\Users\Admin\AppData\Local\Temp\036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2958949473-3205530200-1453100116-1000\desktop.ini.tmp

Filesize
63KB

MD5
4621555fa94a33b3deed643a0b7abd55

SHA1
dc98b3d9bf7aa84a2f75d482aa3fd0ab3481af8e

SHA256
299c2943f86ced132c04916471eab3cfd320a52f89b05dc0f17ae36cdd8d2c30

SHA512
1dc04bd8ad80b54120dbec9e366759b3a74212dfa85629e8ece994f0bc2b35031e9cff76aafa60ca0e2ba386473933343d2c3ee2f0959903a982fae3718e0dc3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
ba2fdbcb66ffaf9922ca28386fd593a0

SHA1
0f33e4d9efa37d9915818accb4fc65b5d2ed3ef7

SHA256
4681f87a4b40075004dd65608d19f63c061e1f20cfed098194369f1c3f3199ab

SHA512
904c1eb4846ae34ca43bf4f63a4406a14a44289ffb0c2bdbacc7c1b26f9984e9a5fbb1c4c6fd6aa042fc73288195369985090c22fedad0eaf3cd67a7f4e0124d

Download Submit
memory/1596-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1596-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download