9b4ff27b886ffdbd1ea2e87e0532be7ea86751773f915ab7043959730061dddf

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85e92827304c815eb517366f9136c470N.exe
Size

28KB
MD5

85e92827304c815eb517366f9136c470
SHA1

131e5cca61ba5e775ae37ddd4bbdb660274f1348
SHA256

9b4ff27b886ffdbd1ea2e87e0532be7ea86751773f915ab7043959730061dddf
SHA512

6f9ed9378b5a6a5f4f9dab967a0d9a2414f4968b14cd050733182692456182c205d7594b3c8c07b57f086ee2f3877aa1a2ebf366a49565b551e290c13bb0044f
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9ZJ1:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ZJ1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2640-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\StepUnprotect.m1v.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-runtime-l1-1-0.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	85e92827304c815eb517366f9136c470N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85e92827304c815eb517366f9136c470N.exe

C:\Users\Admin\AppData\Local\Temp\85e92827304c815eb517366f9136c470N.exe
"C:\Users\Admin\AppData\Local\Temp\85e92827304c815eb517366f9136c470N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
29KB

MD5
c35703b67128d4f5a1a0aa8fa802f83f

SHA1
721c603b702aa54b81b7134a657d123cb2974e25

SHA256
efc6c442d2468069a0f5ce183f447ef902aeb3e0b6ed5e7dd69f69f62925aa57

SHA512
dc92bd65b2452de3b6b980e94134b1378210bfff6aa6bf66c29c824417ea3c78bdc39a6b9f208bef93326fbed34e4aac2a2b536dbcdb0f9ff06adc9a12cfe194

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
38KB

MD5
108e0f4438e39fa97eb8494ed0e3245d

SHA1
552cdfc564f06943ab2f794eedc01da9ea0a3663

SHA256
d7d279c3f5ff9355da3456896acd224a1381998102e03641a518eca6f6cc9d96

SHA512
6ef09882fd3fc0b1057f76bac94ee16777aa34dee7b9a224d6be38729cf70d210bd94c9c2646773a0a4ecddce2d71790aae0ccb7c7c67c094c7d47a575f95181

Download Submit
memory/2640-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2640-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download