fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
Size

92KB
MD5

898324b3d28449e28a61badfc30245fb
SHA1

4251c27892afbe308c910bfbedd07e55cbbf08e6
SHA256

fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a
SHA512

983c89bda61efd56eb6f3e023d3f8df6bc18387547eaf2fd1d55d66bd277062c274f05faf074f9f6b8a9d2e0ba0dd648a671a65c5778aec7edcc8787ef98b720
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTs:fnyiQSo7ZQ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3756) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b00000001225e-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2188-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mip.exe.mui.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\settings.css.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe

C:\Users\Admin\AppData\Local\Temp\fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe
"C:\Users\Admin\AppData\Local\Temp\fd2093e45ebe27e652c658fd254a7ec7cebd3acede1464bb8058d6bcdb74d86a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
93KB

MD5
e1b1eefe78bc1de38c0a7aa036b612bc

SHA1
5f57d87de3b128fb0151678527166e4c5b8e24c4

SHA256
391bcb5f204520bc63decb85afcd65ac062b3a7ba52ea689fe9aead9b38d6d38

SHA512
713820f196359986a9d7afbc35bf2fc014debbb328e559ee24668ef1cdc1370996dd46cd13c176ed5bc806219b2c7e9eb49ebb7c581f506e290dc0cec3663e8a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
102KB

MD5
e07bddda90352f7d7c25b30a91075b1a

SHA1
1a0220f8b94777b92be53d343b06c70faf678789

SHA256
e0fda1ab16c1c4873151481bd9027a10b184649801a1b69aed47db736e425ebc

SHA512
e80cf3fae2c0fe27d68a17ffc6f875a2792965fa0c06f08bd96896203f4f361fed5d541376014ac9685550e099de3096714accbcfe5eb078036a404654548933

Download Submit
memory/2188-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2188-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download