dbe4bb2932a4106f0cac3c30cba8c998d73c7e3a93deffe8867d7fea94e959d7

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278a3ea52fb307ec9b6501e3c3bc2590N.exe
Size

88KB
MD5

278a3ea52fb307ec9b6501e3c3bc2590
SHA1

1b361953c6f444e56ff3681e8485410aaafb9859
SHA256

dbe4bb2932a4106f0cac3c30cba8c998d73c7e3a93deffe8867d7fea94e959d7
SHA512

933dfabf5db7ac398e79663d904964b0207572e50ab3f9de3420c242aa326f2747176c93e5927840b31aeaad40e5fe72d2c378788ecde22709792d5a73d2b200
SSDEEP

1536:V7Zf/FAxTWoJJZENTNyoKIKMmr4TW7JJZENTNyoKIKMmrH:fny1tE5KIKNtE5KIKF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2620-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001227b-2.dat	upx
behavioral1/files/0x0002000000010557-6.dat	upx
behavioral1/memory/2620-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l2-1-0.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	278a3ea52fb307ec9b6501e3c3bc2590N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	278a3ea52fb307ec9b6501e3c3bc2590N.exe

C:\Users\Admin\AppData\Local\Temp\278a3ea52fb307ec9b6501e3c3bc2590N.exe
"C:\Users\Admin\AppData\Local\Temp\278a3ea52fb307ec9b6501e3c3bc2590N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp

Filesize
89KB

MD5
3073f66e6087e5e253a42e08440efc57

SHA1
f368e0a13c1de65fb1135891dbab47a8f10dd97d

SHA256
132a5dc5fe45873f4776437a5e1490f6448be90b1a7360554b7ad4feaf81b290

SHA512
ce8d8537f39999d64a4df1bf607d5d6a6c0f084e55b13409b9e21ad9274991c0acf23bc84e4ff77d0d44c879d2ad2b930000a938f674e743f3ec9c773805bec8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
aad63432e5a555ed5cbb0c088339e146

SHA1
75e883a3014071c88c0c0493636f3e7b6642061b

SHA256
0c5decfc4c5767d893c46ef4d500995ab2d2046093d39c8d45db7c3438921b93

SHA512
c3457bb4ca9ecafe625314022b96d7c9bc6c39681eb8e96b599b8f8747882fd6d69ef386b2e2e059db31f113d07179bdffaf8bd94b3ce92d2d33c10d7eee77c0

Download Submit
memory/2620-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2620-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download