d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
Size

27KB
MD5

2e4ef1ab8318762205d152e1179d8622
SHA1

e7432ac530ca072a0d9df6933b460975854ab363
SHA256

d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d
SHA512

28f3dff7dcc1e0ae3eea6b93b27a68b57d253783af634d7e7a0a0735b57f59584f6c49614fc61054679fede9ff60022b3f75b66b4bb25e9b783d925e5e945a47
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9vND:kBT37CPKKdJJ1EXBwzEXBwdcMcI91

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1064-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/1064-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\init.js.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png.tmp	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe

C:\Users\Admin\AppData\Local\Temp\d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe
"C:\Users\Admin\AppData\Local\Temp\d1e5f73a8752425bbdaff94952e0fb0b484db9fe9aec01a85b6d377b1825c07d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
27KB

MD5
38e2b9b8cd5f8e090dc6d1db096bd52f

SHA1
5d62ce2d4ba934e467bcbe5ac08cc16d0c696ffb

SHA256
f83e4674adb1d9f7e5e53b2d166f4082733e85283da2867437af129e971cf862

SHA512
003ae01c07bd7668e771cb52c15f6c52aa4f526d3ab1e00d2615e0dcbd669c7495d0713e67c0dc7c48d0e3b278ed333390649b1e6780aec24a433cb2256c69e2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
36KB

MD5
cf8d8333edc700d17c5672543999a91e

SHA1
cd9ad0252f5a7a5a5b26f377b63888137cbd151a

SHA256
8a24feca4030a626270098e671fc36e00484c82197f21c98484bd72518f46718

SHA512
cca8871438ac90ce6dfc3a5bae0fc91775febaf974de570b88c62b5b28c1dc80c5b23078edde654e4276c2a0e1b64fae2c68dc90862597205880ee71fe4707f2

Download Submit
memory/1064-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1064-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download