09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
Size

91KB
MD5

17312f4f97bdc161606969ea50ac6fa1
SHA1

22da43de05253af147f39d8e402dbd9c33ab88fb
SHA256

09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee
SHA512

9b837ad10906b1f7e9e54da52a054e3b6cd1406048c9488aa3c0232ddff0efca8ac3c04e6694c1fd100a7847f0f59d82e67a794e85d01f3389e51c0712f4ac0f
SSDEEP

1536:V7Zf/FAxTWoJJ7TTQoQlR1T3qAqK7abHJZKS:fny1oRlR1T3i1ZT

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3478) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1296-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/1296-72-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\MergeWrite.wmv.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill.tmp	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe

C:\Users\Admin\AppData\Local\Temp\09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe
"C:\Users\Admin\AppData\Local\Temp\09ad75a6f9b39635787107053be0ec9c447de01cc1c5f0f677b09f09b74e48ee.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
91KB

MD5
c63784cfe59b8bc6e07c1f9fdac41cd4

SHA1
3a9513c9474beb518c8a08adef3bab9518f8d964

SHA256
75837ba5fe3ed406367fdf3caebf9478a9795c89cb2a0c03c1d77976e70a907c

SHA512
1189be5f1923ef00dfd5ee72c04c0a06c0088ed779b509cdf192abb57b4ec99a33a6acfd48aa77c89ffdfc2d66949282368ab9d76d2e9b88a57feeff70606f13

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
7f16298786f35e39b170ab5c5f90b7d0

SHA1
a1217b4300bd8c8f40785e381578458f95dc5115

SHA256
3f1fffc9ad797306b6abdd44d2cd2ece8eabfbf72cd0780838478687f70e18b2

SHA512
09eb71d03da18168e8b9a96d6a3fd89af48b6af97514008f61f74f449de97b7a89e0b82f8ac1ed619252685057bb39eee0df5ce5fc4bac5a549e022b60ca4afc

Download Submit
memory/1296-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1296-72-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download