85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
Size

26KB
MD5

2ef1ab3680905f42e4106bf6b6802063
SHA1

db2c8a225f03e8b5286272dc40cecbcb2991f375
SHA256

85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3
SHA512

6003ef1e868ea0388e9cf6e874ca6644430a8cf1bb68cdda861f027f65af2a395683fdfd684a4bd4f7a1b6f606a4bd383df36f3fc65618607fa81252f3938730
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJIZr:CTW7JJ7TPUd

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3853) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/2848-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\css\currency.css.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\RSSFeeds.css.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnetwk.exe.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\init.js.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\45.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe

C:\Users\Admin\AppData\Local\Temp\85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
"C:\Users\Admin\AppData\Local\Temp\85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
26KB

MD5
d1085ab77703e0b129cd10cf8fb238b2

SHA1
b56de5c8ab7ac84ef3437e9128b46da37ab5c48e

SHA256
06203f30a694bfa05cf21cb591ecc120ad571b8ce92dadb28a77308610a129ce

SHA512
f652eaf1894c281b64621b57c3445a9545a0dbaf8614787a29f052abaabd5ec6b7305a48802d6aae70e48743ecb279a6a50cf2c7154e7a20e8a23e68bc8976a3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
35KB

MD5
b61b24361795b2b77d4029d5a5ea0394

SHA1
76da5c3c33c15ffa451caacbcb3d6e24bce3a7db

SHA256
2a4936054a0fae0516d8b21904684061399076bd10ac7fc4d8da764ebc4a6b60

SHA512
dda3aa1955637884daff6e248265ad98c3a1034b4720e8a8396a698003f91ff6dfb25f09e6c6a69aea8bb45af87e853dcc50104c65b221f2617a954401b0096a

Download Submit
memory/2848-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2848-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download