64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
Size

83KB
MD5

934d8e7820f7aefbd96e7a2d8721a11d
SHA1

c3439204f3586ab7589e52c1b5efffa2d81e10d7
SHA256

64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b
SHA512

231f960d6a82c745088741582fcba1de7f1a810370ed82487d9825dde88438164e68871260b47307c8230e16364405c9bd5109d2937bd084f90bd0e1d9cbaad7
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgLR:fnyiQSoFcl

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2516-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001227f-2.dat	upx
behavioral1/files/0x0002000000010622-6.dat	upx
behavioral1/memory/2516-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Journal\NBDoc.DLL.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\jvm.cfg.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\triangle.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe

C:\Users\Admin\AppData\Local\Temp\64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
"C:\Users\Admin\AppData\Local\Temp\64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp

Filesize
83KB

MD5
f461d85f496ef03df73f94d1a44b27ae

SHA1
81435e4d56c8eaffa2e530a79de11c09212a8b8a

SHA256
3b7b4d30186a6a4195b993378b7c661a16d978eaa7f28ef4679201be8eeb47b4

SHA512
6bb4dcf5ba023fa4ecf468e378c2ca81eab944fe4f51ee5c925eaa0e12b12a888f8a2c68866ffb8d52f2aaaa104f6b9b0f271dc5b056aded2689c7e14d2e1cee

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
92KB

MD5
2031a173264aa6860ba16900052c248d

SHA1
96a30e87e41afb06a71f166001fd4d22597901c6

SHA256
9b2aef54be022fa953038e768396998bb4788bb95cad8aee7e045217cfe80e6b

SHA512
e7c85606034f8d7d309c17db295d13dee51d27865cc99c0ad774109ce66a8df9dc597d78221bb58b7c449b5439ef6cba69ad5e508fa919624829f60918456f67

Download Submit
memory/2516-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2516-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download