75a8a4a9b8038211a123d8f2782e9ec1adb1d127e62f90e6342eea13d4a9f084

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

142ccc6d3ebeb5cd7868e094800a5290N.exe
Size

43KB
MD5

142ccc6d3ebeb5cd7868e094800a5290
SHA1

691f746344b32b5756b77fafd2fc6380bd6c7cba
SHA256

75a8a4a9b8038211a123d8f2782e9ec1adb1d127e62f90e6342eea13d4a9f084
SHA512

81028192e4233704fbcb46f2d1bd4a60b9e0284de4762b277791cdcd973b3535fd3f54ddfe74cf7dc34b318029c84e4d7bc68a5a0149ee19ee12ffc15ed7c182
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/titcItcIu:CTW7JJ7TTQoQVVu

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3300) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1696-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x00020000000104f5-6.dat	upx
behavioral1/memory/1696-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\ChkrRes.dll.mui.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\ApproveConvertTo.mht.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	142ccc6d3ebeb5cd7868e094800a5290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	142ccc6d3ebeb5cd7868e094800a5290N.exe

C:\Users\Admin\AppData\Local\Temp\142ccc6d3ebeb5cd7868e094800a5290N.exe
"C:\Users\Admin\AppData\Local\Temp\142ccc6d3ebeb5cd7868e094800a5290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini.tmp

Filesize
43KB

MD5
1e8bb7b3dd0d55e0395b58d5b6ac2880

SHA1
45921877e0013a0bfdcf99041e2644a798cc865f

SHA256
dd966859343afd4b124e65c5abc9a7e2ac6127ee6cc291ac88612a0f331b6d00

SHA512
d84b12baa6545c02ef2e7623de6df31087ff2d9c058444cad611c03dfc071b3f4ffca7cbd25fbc927cb4fda556b5fd7a3490118212934b1c3a035895c1f88171

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
df97ef0357060a783d509f61f6eb8557

SHA1
b833236e9f76fed71d5d0f71368830eae5e58ea8

SHA256
fcc9970fcb1be7af39ebf578f88ec2b9a64bc3c0cc61b999008d3e0a97bcc41a

SHA512
42b1ab49087a20ab4e86efbfb83481b8eeb84c17f09d3e6ff1b81d16e8c6f210243ca8aa2efd182d19280add6ab1be9720209dde2f6e06f44cb936d6251a1d99

Download Submit
memory/1696-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1696-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download