fd30fc16e39c8c18dd202ca819ef4251e2a0004b5231e4a69a4a5390ce721244

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 05:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ba6704651f47e8c39ccfc649c0904c20N.exe
Size

50KB
MD5

ba6704651f47e8c39ccfc649c0904c20
SHA1

07c32376c85fddc2b7564219855f7f7dbbfb0720
SHA256

fd30fc16e39c8c18dd202ca819ef4251e2a0004b5231e4a69a4a5390ce721244
SHA512

f670cc8a4199db30c08eba563e68bffd3d613a19def19aae2f9945dbe0ee8f94f4f66ab1a6184aaadb9032443ecfaedd2fd28f1eed7ea418601a36dae2b1191c
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJBZBZyF/MF/orMalYNRo:V7Zf/FAxTWoJJB7i2JalYNRo

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f8-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/2436-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	ba6704651f47e8c39ccfc649c0904c20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba6704651f47e8c39ccfc649c0904c20N.exe

C:\Users\Admin\AppData\Local\Temp\ba6704651f47e8c39ccfc649c0904c20N.exe
"C:\Users\Admin\AppData\Local\Temp\ba6704651f47e8c39ccfc649c0904c20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
50KB

MD5
4565c332803d17cd12558af66de76b9f

SHA1
30a72fa635375be31f30002213c188e6a59cfc21

SHA256
6848c5b576d9cc3bec47c01dcb10870b36020040a61f0b12cf824293cf315a13

SHA512
f4e89ce906b005822dc7df2cc408f9c98925756bf3438233b8b689ef7d7e0ca4ac959f2126cc496f0601969610d3a3dc705f1db22d50ef8b28f46ff11499a64a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
f8eee662e960699e0c5507e321cf8098

SHA1
22bd73bf1abc0e2aea41cf46c957678b811c7c08

SHA256
b6c4095c7bac681d8c97d43bcb1349fc99876b28978b9c38967dfb517ed6af72

SHA512
2d17e928a2d5228ea5332ba6b8e40ddffd552992c9dd54c7f18583ff3580908fbb39227dce2e05e2196056332052beb26412db01748abe474d9bb929ed12b52c

Download Submit
memory/2436-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2436-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download