4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
Size

59KB
MD5

48ea42b166f71770be1c96f027276bd0
SHA1

70616c8217000cfc49d79f9d45b63d2abb6092f0
SHA256

4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09
SHA512

56a5d950f6a42308365b8666220ee6dc1c6e4ef0e95727b49daa09366a758163a61e7a1a91f3f50b0f3ed073e5b583e7639521f090640cd6df196700cd5d6758
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9nj40g40z:V7Zf/FAxTWoJJ7TJLgLz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3707) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/2556-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2556-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\TestReset.ram.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMC.exe.mui.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\MergeUnprotect.docm.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationProvider.resources.dll.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\gadget.xml.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe

C:\Users\Admin\AppData\Local\Temp\4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe
"C:\Users\Admin\AppData\Local\Temp\4222e678e8d1d7adf3de63b34ab20022c4e8ca206b59afffe92cf66db2efce09.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
59KB

MD5
78e7fea9e87e78fca9552ec63ae4ccab

SHA1
e5c7bed146914097d71fde15fbe8e2204c98f6ba

SHA256
1ba8f9442c9c0964e477ec07692e524c81bf8e9aa2037f6d67d678915e7018f7

SHA512
ce51bcbd2f0fdf84a0ecd29a9aafab8209245b4b464f3917b1c5961cfd1d2126303181153688477bfb520773ff74630afecf672bd8d09a26c099f5b8f4326751

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
84ffcfe32c633c6d3d2e2ecdc59d49de

SHA1
1e18b49eee21c92a5985cb1ce09c413f8dcf5c48

SHA256
ea08ace0c01596ca8d2abd7edd0a6c18c7ba08398b1efd1e5032c33dce1bcc3c

SHA512
b5adbb3b095fa7a3e574539f73e6c058a48117a50ac6fb36c2a88858cb0e15b9624d12942a59cd73e9334f9ebffa6c3f58288448637750db3ec1a65f317e5cb8

Download Submit
memory/2556-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2556-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download