e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
Size

47KB
MD5

95301d5441b69464d7c21bd6ac66585b
SHA1

973402a7c9a0bf76663f475534d5cae76d154bc5
SHA256

e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e
SHA512

61dfc794efeef154f16fe0bf0a0df3e4d9f7cb6e544b3ddc96746f171d70e08fdc62845cfc86aa243ad6fdee78e9d731122cec78c7fdfb4d1f50d9e2152d9e5c
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiISKSz3Jw/eReJw/eReu:CTW7JJ7TTQoQIRR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2104-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.ELM.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows NT\Accessories\wordpad.exe.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ADO210.CHM.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libaiff_plugin.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\FM20.CHM.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe

C:\Users\Admin\AppData\Local\Temp\e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe
"C:\Users\Admin\AppData\Local\Temp\e643744a854f3ac308763553f8281335d1f003251a63f8239b6222895315af4e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
47KB

MD5
59013436e209012a4ba402437c9d53d6

SHA1
5805a87fc59eb3def7af8282291a0283f08b3474

SHA256
dea0e85767b5b5f244cd04df078e05448b83f80c4a26131c163af3553e1211fc

SHA512
051dbeb3ea228b8f2b031b99dc1ce4cf53a40ab7a8a875887a7c5c7575dc2f98ebb9239366f0cbcbb1e6a65e14a51c46d8292da6080ca53897d8b00302af97fd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
475bf83bb3b5593fd672b384f8d001d8

SHA1
949fd1a1309679f8343bae5d3a8cc8d78eaf31c1

SHA256
a9c203dd5713ee6dc69c59400cd5fd0b80030cae32d8361f3a7a98ebfc3a4d9c

SHA512
dde11e63bf6bad8af5526b881b0943382887814a33d3a30969d7a13c06123ffa37cc70f1d63cff6aeeee2847d555ec772fcad340fdef07495ece04c4f5ae9826

Download Submit
memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2104-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download