9fb9156ef36489130e4a28d0174d0e5567abcb19740045494a9d1dfa43d341d3

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b368305c38abef8613f196205e1308b0N.exe
Size

26KB
MD5

b368305c38abef8613f196205e1308b0
SHA1

6af9a4f6cff267afda6690a28801d135cdcda822
SHA256

9fb9156ef36489130e4a28d0174d0e5567abcb19740045494a9d1dfa43d341d3
SHA512

6af514982c0882fe63c491a6494ec2ef9176bb934871cfc814bea14629a50f2ca1e6b400880bbcc1b412a87efb0adcee52b8eec2348fa543c7a72f2e8d1bf926
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9maVQey:kBT37CPKKdJJ1EXBwzEXBwdcMcI9A

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2875) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1316-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f8-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/1316-63-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\release.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	b368305c38abef8613f196205e1308b0N.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	b368305c38abef8613f196205e1308b0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b368305c38abef8613f196205e1308b0N.exe

C:\Users\Admin\AppData\Local\Temp\b368305c38abef8613f196205e1308b0N.exe
"C:\Users\Admin\AppData\Local\Temp\b368305c38abef8613f196205e1308b0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
26KB

MD5
8164d66b9541c49c89dbfe2cbc2c78ef

SHA1
9c2781011a8747ed86491b4d284ebd4b6787de4b

SHA256
0e4a94a62e48b9a7ae9682e2645e59a04c3e770f6cde086521ffe32b4926295f

SHA512
a66d7a1722ea3510fe2dbd1631e7b18907fa5de3a8530c51510f97a0b991a7e2a3605e2d50b6ce7c7ac85a0a40f4989944e758ca166abd67be38ce9448f4eb71

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
35KB

MD5
66ede2ddfd0e4aa19854b86d0829e63d

SHA1
67f8783184fd0773f7cdba801df2fa3ba5bb1c76

SHA256
1ae4b6c4cbf813a8650eb360f8489d9ac9fb74c0871025a83c91e880e48dbb2d

SHA512
d8869a56f7a4529188092edab1a2f3bd4763cbc14dc093e59d7f51982f584f5229def80c40dcc3d5d6af798f499f25b0e29411e86ebfa11e8d7dc2bd85615e16

Download Submit
memory/1316-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1316-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download