f24406eddeaccd0404b8e0d78495e9a95b1dc6bff87f0b74d83ccc4294c8fb7c

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b40684ceb66bb262497250ba06e06120N.exe
Size

49KB
MD5

b40684ceb66bb262497250ba06e06120
SHA1

040643bae8ce5d58b2dea4906867ca57d4cc7343
SHA256

f24406eddeaccd0404b8e0d78495e9a95b1dc6bff87f0b74d83ccc4294c8fb7c
SHA512

a37de16257aca373d90caa35c117a032b265a99efb9f42c08fac6859358d4b9208320a871e3c3d1323724758c648b51f1c95a75190e9a7b3a05dc27e96bb4adf
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI97LjLNLjL2ol9OiJfol9D:V7Zf/FAxTWoJJ7T1vJv/GV

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3400) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fd-2.dat	upx
behavioral1/files/0x0003000000010330-6.dat	upx
behavioral1/memory/1632-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b40684ceb66bb262497250ba06e06120N.exe

C:\Users\Admin\AppData\Local\Temp\b40684ceb66bb262497250ba06e06120N.exe
"C:\Users\Admin\AppData\Local\Temp\b40684ceb66bb262497250ba06e06120N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2257386474-3982792636-3902186748-1000\desktop.ini.tmp

Filesize
50KB

MD5
6fecbd586d867b320fabbfa0504c910f

SHA1
4ced97a9cdaea2727614d404b4a76731a3145cd7

SHA256
7489c25671dcacafedb8b5cff5de5f40227e39524e846591b44a7c0ac462a5e2

SHA512
2098d4d7c072bd1bef1bdd2888af0175a8fefa67b00d6921f8fa3e212c12984458593163a641fab18130414089e54c4b5598ed5d1836b061a8c1adb8928cf446

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
a336360a68bebaa7d29afcdbec86c6ec

SHA1
47ea4a74438faaee4b9d3188ff9ee1a6dd27ac2e

SHA256
95ca971f0f34eb736cc2060779585195ae6821fa661c2720f8267e4127e51ca7

SHA512
db0b7b7235c3c7d38faa8763e7438eb3d9d12620641087d37e8645a8e0f120f3bdf38f243a6f4a1c334b4ac92123981b2d0a4682e28fd700526b4ec1529ff11b

Download Submit
memory/1632-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1632-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download