b524e3ed3bab2f1183b2a1e4c132992b7b42dd3fbb120a6ef2920c7ab899c99a

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab09fa6ffde15530935106f67d2b4090N.exe
Size

25KB
MD5

ab09fa6ffde15530935106f67d2b4090
SHA1

2bb3356c7e15251f838455d4815ac74697363bda
SHA256

b524e3ed3bab2f1183b2a1e4c132992b7b42dd3fbb120a6ef2920c7ab899c99a
SHA512

e9f07b01990b596deb445cb0e3a31694c62a45f77db6b6c88f64bf4ff439f92a47d3bb093bd7c10517b6e09fafb5e239c32734cf8d23980d8c467641d9538cc9
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9O:kBT37CPKKdJJ1EXBwzEXBwdcMcI9O

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (527) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000014132-2.dat	upx
behavioral1/files/0x0002000000010463-6.dat	upx
behavioral1/memory/2388-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Internet Explorer\jsdebuggeride.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	ab09fa6ffde15530935106f67d2b4090N.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	ab09fa6ffde15530935106f67d2b4090N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab09fa6ffde15530935106f67d2b4090N.exe

C:\Users\Admin\AppData\Local\Temp\ab09fa6ffde15530935106f67d2b4090N.exe
"C:\Users\Admin\AppData\Local\Temp\ab09fa6ffde15530935106f67d2b4090N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
25KB

MD5
1c954e9a98d578f3a2d565cc648eebab

SHA1
6381a714e96561ccc942a8156a1b069084337ca1

SHA256
dbc6224bb1eb324c19d09f06a24c954dce1691b8131f2d2ac5691b4a1638a9a0

SHA512
f089ac9d11f633f0fd99f954d3478a292c4c9030113219885bb7871add50ae840247d56fdab0166fb7ba7c25d484c10cc2b6c62a26c6af7389f9a43d256126c8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
34KB

MD5
bc5d5ba105672b509311116607207cfb

SHA1
b816e0850dd96b19af8130bddf46aed3c55d8335

SHA256
8afe11df3c91f80c74d2223c2ca3da3f17b342549006b7f5ed06e38e4036f4ed

SHA512
d2f48b89b03bd1398caac5b849e33b7e099083138b63c09af28bbd822f6994becf9679b7926545e163f62294730975cc551c4db3665e34748c25ade3297497a1

Download Submit
memory/2388-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2388-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download