e34571ce3328538502f2910fca0d3edd61612a18b58c751e7a9636236691bb47

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f9de3e4ad33a837b71b90995ea7e400N.exe
Size

36KB
MD5

3f9de3e4ad33a837b71b90995ea7e400
SHA1

30f4cfa12f7055544b8adfc5b36b6d4e59cefae2
SHA256

e34571ce3328538502f2910fca0d3edd61612a18b58c751e7a9636236691bb47
SHA512

92b9a59033c9adda7ac9ced1a1483220d48868a9c990d118ba54b3e203fec97a29a20a2225061baafc148cb2174d293ff303e8723ff7655dcc252e0bdf98facf
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiFneEn:CTW7JJ7TTQoQwEn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d000000012276-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/2972-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\License.txt.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Windows Mail\MSOERES.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	3f9de3e4ad33a837b71b90995ea7e400N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f9de3e4ad33a837b71b90995ea7e400N.exe

C:\Users\Admin\AppData\Local\Temp\3f9de3e4ad33a837b71b90995ea7e400N.exe
"C:\Users\Admin\AppData\Local\Temp\3f9de3e4ad33a837b71b90995ea7e400N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
37KB

MD5
f3e0ccd3e1db9215c433d1c788426427

SHA1
28eb01fc42fbbb982c81739be1c3cb19b45166c5

SHA256
e5b9ffca895cf89bb6239fb8aa34e4deb3074c1cf5cf387643bf0a957ff1ae4e

SHA512
d225408efdf8d6df07bfb5fd864e91b8c438332812347fe1a3ab9681d8ff90210b5b06e69bf93f5f95ff27180a8cae0a1c8e0be0055e57e8ecb6ef4b224ca22f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
c12b0add45904d1867394ad1012697a0

SHA1
6396ad85689203c28322c03c66371fd47a60c14a

SHA256
0aabb68c3ba13b6bc3582d1947c6550cc6f9ced3e942237654761c7e8ea32bc3

SHA512
81d0fd44694370880ce22cf839471db9d732d02e26f68dc704c6375bc33f4d415ea70e6449dd77c9f26c053045fcf1c9a8c92ee8d1bcaface55dde9b66da6790

Download Submit
memory/2972-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2972-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download