40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
Size

32KB
MD5

0c424dbd79811a7686afcb87c145c131
SHA1

e70b634eae6d28f003606499f722988d1beff2c5
SHA256

40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9
SHA512

b641af75d242215c6b6dfa0ff3befb1d026b1634e1608672b57866bfa06beff512fb08883e276498dd46b2b5bcd513a393a5fb0fab8754b9a74192c5d4d74360
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBy9e9UfZfKF/MF/O:CTW7JJZENTBy9e9J2W

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012246-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/2852-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Mozilla Firefox\xul.dll.sig.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_hail.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpsychedelic_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Mail\wab.exe.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\sidebar.exe.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libposterize_plugin.dll.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\gadget.xml.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp.tmp	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe

C:\Users\Admin\AppData\Local\Temp\40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe
"C:\Users\Admin\AppData\Local\Temp\40313dfb1e7635e86f6c6b85f05f0abe4dd933f0a677fde1ba8d5c06b1fa39c9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
32KB

MD5
08f89800e87e3c21161e52fb0f9ad87c

SHA1
d3c6c97de4fe9c8f9560b3d3aa0b95006574102c

SHA256
b310ccbcc36e6a3812ac158680a82d6881a2c36688e793096a5d7c7f03adc7bf

SHA512
b30c1a0c2f3ca28ea0b325f536c8d5de9780f017daf8c52d4806aea3501c352d7f0d6f01028973d8fbc9360b3c15f3927f3748c299f79e87c5391a3588fe0dad

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
41KB

MD5
aa7945a887f8e692ac57b9060953cbf5

SHA1
ca02436d4ecf9d1c26c5ffb57adac897172b003c

SHA256
050b2da7342a9beb2421a41b66f7fa4f45a5e975ac821fa89b6ef6f36ac934e4

SHA512
fda28e83e1943af9b4edadf3d7b7aa3f3b810683922cc6ffe008fa50d5f928b2a7bcc5cde8d64f56604e577c0cf67f57aeaf70528b880b9c8c6f4120871697ae

Download Submit
memory/2852-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2852-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download