91acecf79fe8b39e1476bfacc0e7e28db9c8cc370feff0132b4468ce367dc166

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31a224d6c389a9c9678ca69b30a14b90N.exe
Size

33KB
MD5

31a224d6c389a9c9678ca69b30a14b90
SHA1

cf28d036756395f93468b110fb3994c1d59c2ede
SHA256

91acecf79fe8b39e1476bfacc0e7e28db9c8cc370feff0132b4468ce367dc166
SHA512

d95422a47ab6af0522c6ed3228fac93b25ccc30d94402271999d146ad77735da2a30308164dd0cfce801d56401e7695db5b001c54b5e56269d4f740afde5b02a
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBApwp133EskmKsN33EskmKsZR:CTW7JJZENTBAOIfmKJfmKQR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3376) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/2232-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	31a224d6c389a9c9678ca69b30a14b90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31a224d6c389a9c9678ca69b30a14b90N.exe

C:\Users\Admin\AppData\Local\Temp\31a224d6c389a9c9678ca69b30a14b90N.exe
"C:\Users\Admin\AppData\Local\Temp\31a224d6c389a9c9678ca69b30a14b90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
34KB

MD5
ee4a7c4ac7968346941f1df8497e3f2e

SHA1
8feb4259cf136c69152d6949667b4e3cd9a5e21b

SHA256
d604626fe0b6dc6b62413a0c4f2e574134d146cd22b2a657b2985b1246ff7dd1

SHA512
80f7013299c4ecc7661f5f7173be885f9444946208f81bff79cac71e292b7afab55ee0f774fccf61e1b2cef50352463450f7dd5d7dff8038b481f751ffc25e5e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
42KB

MD5
10a66b0537aa55ed67c9e88689e84647

SHA1
deae7c542cc99af0b8377871cfa1cc6c02e225c7

SHA256
51cf4de69dc1215b9d04ae8c4fd5d09a19f3a411c6ba99c94dd72eb1224a015b

SHA512
edaa19064b93b3cbfa08760f22187ec75a72d0103d89a9325d4ad208501ac52fe16f8ee6b8de547751247fe9713438c10f110c92e156bccae8381eda2616de45

Download Submit
memory/2232-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2232-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download