1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
Size

25KB
MD5

99e6bb5f56fbe0a15a53db813c71ab99
SHA1

21f506816cf8623ecdf97d3b97bf7bcb9f5514a6
SHA256

1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436
SHA512

ccd759d0d9022e19a76a0be2bd9fafb5c46c0c9e22f884b7f55e01013d20b3791e64d87075ba368b4f43d82d754789db82dd49eda2b18dbcd91ae2b0772dfa91
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9Zmuk:kBT37CPKKdJJ1EXBwzEXBwdcMcI9nk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3704) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2136-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b00000001202f-2.dat	upx
behavioral1/files/0x0002000000010663-6.dat	upx
behavioral1/memory/2136-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipRes.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js.tmp	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe

C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe
"C:\Users\Admin\AppData\Local\Temp\1208a27c7c8e6d68b031e5e432ac56be212bd2829153e7ad66671e7fb5ee5436.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
26KB

MD5
e84ff109d5d2af94b41dc2be645e5520

SHA1
91a12ac83aad00ef3c8724f57747156b7bb026be

SHA256
4c065272d31e34db90326fd32f344ea99ddfb81c73b39ef51ac572be7bb471e0

SHA512
86b95693a3a3cadb7663d21197723d8f155e75fa996072b1fa29142f38a5250b9ace0c2b0adb4704eb98ae6ba318262739570b47ad7785c261f3f93a1105c499

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
34KB

MD5
bb60d69aa8a54851c1adee1633a19a39

SHA1
3da4f116f6ccd124ea3de3bd5d9e79a31246c54d

SHA256
18aa4464e185d1484dce8257fd8ed530bdadac2af42f46a8770b997c4feef7f1

SHA512
90bd64da2b6473867569c5fc4fe2e58d72a8c09f254bc4f81ed8a21c4a2439520d057a54ee2fa7e9c6ad23b73343a6f5375a832c672aeb677c0aac5a66cbdffb

Download Submit
memory/2136-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2136-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download