bdb137f96928e15c429b25895767d02223038c7c8b94374154603f28c8b05077

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baeb853a3c1d8006913161efed341290N.exe
Size

51KB
MD5

baeb853a3c1d8006913161efed341290
SHA1

90916d5131443cd4a45843b5b654cd20b03b6dc2
SHA256

bdb137f96928e15c429b25895767d02223038c7c8b94374154603f28c8b05077
SHA512

bd5cb93ac12054268a9ec0007d0569f50fdef5919d547175007cc7b41e4424bff08dff1744c8710411ef31bb4b3658bd2f255158d2470db30ce9d5b69dea2fc4
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI98:V7Zf/FAxTWoJJ7Ti

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2632-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2632-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\SelectConvertFrom.gif.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	baeb853a3c1d8006913161efed341290N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	baeb853a3c1d8006913161efed341290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baeb853a3c1d8006913161efed341290N.exe

C:\Users\Admin\AppData\Local\Temp\baeb853a3c1d8006913161efed341290N.exe
"C:\Users\Admin\AppData\Local\Temp\baeb853a3c1d8006913161efed341290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
51KB

MD5
79195cac595b9eb5053da3ba310fb3d8

SHA1
6a2b470dd4c7cde6df3598d756b1a9980bf83420

SHA256
37871a4b187d8f23908fa7aac39fc03c7591a3c3be156b5bb691884c06ea7e59

SHA512
6a2aeb156ff9e9c0aae6cca228be2771bf0a9281da05cfd26024d5d91c9dca4f5276143ccdbd21348f646236025b303cc488c937cd9d1110e88969ecc1e86357

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
0a521532b7039c6b49905286c20e14ed

SHA1
045eaccde6ef6ec4bce5f9ab8f1d5398b4bd19b5

SHA256
2905f269484ad66d138286724ea769115f81ea70fa7a7d76f9bce5369c245973

SHA512
e320cd1a8223795117e1eedb2fe916795ecb3a6664d2660242431a0f2b845c26ec8c88f215e140aafa2e6064c87e6bd2e4d849fa296a992cc4455f3dae90d701

Download Submit
memory/2632-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2632-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download