6f54d34f88f2f8e67d06aeef4bfd2edd74b247bea03a3e7e3301cbc6db7fd5c4

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec618cae6be75a4b12df4a8ba129170N.exe
Size

1.1MB
MD5

eec618cae6be75a4b12df4a8ba129170
SHA1

966b28734978e6d2734740d57d1da3b026fdae6a
SHA256

6f54d34f88f2f8e67d06aeef4bfd2edd74b247bea03a3e7e3301cbc6db7fd5c4
SHA512

1647031a4618c6d1de0c6609e90b5ac91f53961ecad2a873f49c5f9d35058e20d7745a2350088fe00ad51198ecd09795e54b1a712f85548ef665cb10a1572e55
SSDEEP

6144:KbEv73qKc+y+2VU8uwB3xwq23tpNwaXcSl+wb9LlkfnmemoT2oCCP67tFym+I56T:tehAdUCQULlzRc2HK5I5681sue

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2540-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012264-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2540-20-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	eec618cae6be75a4b12df4a8ba129170N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	eec618cae6be75a4b12df4a8ba129170N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eec618cae6be75a4b12df4a8ba129170N.exe

C:\Users\Admin\AppData\Local\Temp\eec618cae6be75a4b12df4a8ba129170N.exe
"C:\Users\Admin\AppData\Local\Temp\eec618cae6be75a4b12df4a8ba129170N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
1.1MB

MD5
9e53ba85d9e4a208efe0a16b215be7ba

SHA1
67f4cea572ec518d3946603921247d192c6d2fde

SHA256
4aafc5aea8ca93d6178b78699dd46304f226e2a7adf4d957eb4c78012fc59bd2

SHA512
d3e92e22ed77491483fd3f6db45f3a8b9ddabdeb35645e79e66070388bafbcfe4119502b318ac5bc2e8fe77ab9dea8470869fb91496cc4c069b82e51fc704e59

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.1MB

MD5
ee0ae3a3e237f4eb53758c1f41d0f4a1

SHA1
7a1b84af126167dce2a03a0037a253315a30839d

SHA256
be99c37e7b71f0eed19bddbf59d079a2b5ae7f60c323acb3249599d9a895886a

SHA512
e4604873ca75b7357c9a05347d52996a2a7b17ea109e787ab8bb9a924cb47f3db04d09fd60fe04d4393af0b9f2eca2307796839622b2dd74f9f94d8a352d097a

Download Submit
memory/2540-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2540-20-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download