ef2d0f0194ac41f708f2f866317ff4656d0abc4c57290f33eac20bac04d02acc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d83a6e62d580c2a5ec6a6899c798e220N.exe
Size

90KB
MD5

d83a6e62d580c2a5ec6a6899c798e220
SHA1

461e8d6daa195c63fba3ca0e402dbcfab0c17082
SHA256

ef2d0f0194ac41f708f2f866317ff4656d0abc4c57290f33eac20bac04d02acc
SHA512

c738019ce95e43153bd207d1c94da5095fc7d069c587be52de5ef978ab25d7d1e9c8c4585bb30774fe7d08ab1677c1ca46d46f921a27449841f7de9982b2b9e6
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCtyT25:enaypQSosk725

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2911) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2244-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_zh_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\imap.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui.tmp	d83a6e62d580c2a5ec6a6899c798e220N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d83a6e62d580c2a5ec6a6899c798e220N.exe

C:\Users\Admin\AppData\Local\Temp\d83a6e62d580c2a5ec6a6899c798e220N.exe
"C:\Users\Admin\AppData\Local\Temp\d83a6e62d580c2a5ec6a6899c798e220N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
90KB

MD5
4dae0e78528c593d06ecf73623f12ae3

SHA1
08ae97ebea544f127d2e2206e6c570521928684b

SHA256
6943165682679e9ad6fa509e23aece02d5a22d59361999ade7c5e81f5fbbdb37

SHA512
6861f4abf8ef106783286ac0885d7ee15447542891f333c4744f5cd61b2989f22a374b23c40a0d8b59edd401882ae714184e4ed2f2ad9fd8fc7c1d93569a5722

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
7a5c40e31ef9f494e27316f0a1c7685f

SHA1
9c68ea3cb8a1cebebab3795e8f722b92389cc586

SHA256
31bf5518c054647f3c159a9891519097f1a31186064277215a02249b94a4aee0

SHA512
d5c26cf00cc1323a55cb44cd747b4a2fb9f69d3b7120e0233f98657569773d0a060ac087bde9fe726b8e455862bf966ecad84e685357250096879722ef1a0b3d

Download Submit
memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2244-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download