73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
Size

42KB
MD5

e0887f35e12b88faf322230f20393475
SHA1

ae26f5d2801075d9784dca0d2381641f90c861c3
SHA256

73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9
SHA512

51ac6abc5c032613e956cca851367bc25c183e36fc262f7f2d017af8237adfd0bf1a93acdc486b26fb2ef0b7e5dc9baa127ad1970cb0869fa13522397d82166e
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54wWbbZd:CTW7JJZENTBWv36o

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3849) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1948-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00090000000120fa-2.dat	upx
behavioral1/files/0x0002000000010486-6.dat	upx
behavioral1/memory/1948-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEWSS.DLL.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libchain_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Journal\de-DE\PDIALOG.exe.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\settings.css.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe

C:\Users\Admin\AppData\Local\Temp\73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe
"C:\Users\Admin\AppData\Local\Temp\73ecebda6dac45806cee97257e3ff594b8c4e292fe3d2fa7a3921deceae257c9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp

Filesize
42KB

MD5
6834f9557684e947eedeb7e6630250ec

SHA1
d9c8fbf1961f131fcae0d4a0256f2a1607e25f26

SHA256
833b1327656adc3f8d5f4efe65a6371df14356c70b0f33d110b9fe79b69e7528

SHA512
4d9c41ab9d1ee48d1641bc18205dc881fcf9aae0b8ed62bf034f97e38417ce6b8b69018e79a712f20feb678a8ed7cd0089ff326f6fc0530799d96aa8d11fcde0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
6e53856dbbfbb8d38909c58ce75e88e6

SHA1
81664ee8504e1d3ba2c295426f6f2c4fd95252e5

SHA256
cb445aefaadfb2c6a4ffb0285ada29d22ba46f5eb8b5673d18b53eb56abf25c7

SHA512
2465b9df68dbf72512a4e425d63d0a1de583e4eb5548454b5f393d6b6245e638d338412c5c192ad31628c4a246673a2ddee8bb8a65a64936cc593f59e46d26b5

Download Submit
memory/1948-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1948-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download