8254f15ef51013017f7486b5e99f067c0855ccfde7e910af13b9e6d0a4329fa5

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a419c693e21e02cd4036836f87ba0960N.exe
Size

33KB
MD5

a419c693e21e02cd4036836f87ba0960
SHA1

16fb778ab3c8764f12904a5d7a2ef828a63a43e5
SHA256

8254f15ef51013017f7486b5e99f067c0855ccfde7e910af13b9e6d0a4329fa5
SHA512

201e79647d1de0a4d48c761c018bdbea44accd83c30d7fae5bd3785642b5e1596c9880952befd139144c83b1d83799f656d83dbb7cdc0ab910eda26ae23f2c2c
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9cGsGJKO:CTW7JJ7TyGsGJKO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00070000000120cd-2.dat	upx
behavioral1/files/0x000f00000001045a-6.dat	upx
behavioral1/memory/2692-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmplayer.exe.mui.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\SuspendInvoke.001.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Windows Defender\MpClient.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	a419c693e21e02cd4036836f87ba0960N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	a419c693e21e02cd4036836f87ba0960N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a419c693e21e02cd4036836f87ba0960N.exe

C:\Users\Admin\AppData\Local\Temp\a419c693e21e02cd4036836f87ba0960N.exe
"C:\Users\Admin\AppData\Local\Temp\a419c693e21e02cd4036836f87ba0960N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
33KB

MD5
b8ec39336836c3da640f77f2eff6626a

SHA1
94491bc49ff99934cc33a95a6d7869fac2bad43c

SHA256
673dd97942ae6ab9514f941c91d6449e7f38512a71c9b0dc55f081218c4dc13c

SHA512
1acad2ddcdcf0bb2d06b7b5cd9e78ef38ca9a0a4cb0c6131dba7b49d968be5cba15f5424af0306a2eadc94091fe8b11006a6fecd5889ecc3c6cdaba486af1578

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
42KB

MD5
56b25a01872f52ff360d8da8fc788ab2

SHA1
a0d33e1c43c6354f4f73dfbb4bcf6cca760ba971

SHA256
ae5ca3d5a2de1f2aea48c85deaca147f9155c5095fa56ecb4e1953a42889fdbe

SHA512
991e4ef047f595aed9110d12890b1ba4741ab8f62147b4fd97df7524044490811f46833c93e0536e22edf2269f1570e49c46628c227fbf6ca37ffdd119563724

Download Submit
memory/2692-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2692-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download