645f03ba0943235772a3214adf6c6c15bf54e5e1a145bc7068f5e851ada06c8d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30f81625cd00934cde87a8cec7e714e0N.exe
Size

61KB
MD5

30f81625cd00934cde87a8cec7e714e0
SHA1

615bf4624e6f1a111c838f17c1a8b1f7da2569c4
SHA256

645f03ba0943235772a3214adf6c6c15bf54e5e1a145bc7068f5e851ada06c8d
SHA512

69d3f59109af743fb8bdb8bd58ab1a6859f7a1b6cdea83dc4015b09a2dd7b8a2d1929c9a4b4b8d4df504b57b46d99e58f8d67c4c7179f9da8685e69c2455b960
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tilQI:V7Zf/FAxTWoJJ7TTQoQlQI

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2524-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libnetsync_plugin.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Havana.tmp	30f81625cd00934cde87a8cec7e714e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	30f81625cd00934cde87a8cec7e714e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30f81625cd00934cde87a8cec7e714e0N.exe

C:\Users\Admin\AppData\Local\Temp\30f81625cd00934cde87a8cec7e714e0N.exe
"C:\Users\Admin\AppData\Local\Temp\30f81625cd00934cde87a8cec7e714e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
61KB

MD5
b3707c98952a1181720bdc2db0548e17

SHA1
7785492b22c493e9725f4b0709c488ba27e19722

SHA256
6ce93851b6900c4e1a0749bcdb7ceddf406210e8876b88a450cc0e33a121372d

SHA512
0257ed7ba056db17f67e73eb9bdca4fa33de9b5264fcd3e868078866c0c2382b3aa9f036ae7df3e68db645c63c89e4a0586922fd0e7afa89f845e54e05ac0727

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
70KB

MD5
84363fee8633dff448185140a7e7fe06

SHA1
654b1ba38aab87e7245a552cddb2469d1b38e332

SHA256
76f3e2dac9288c58729109b5ccc1f2b531ef0d18e9e65c66018e09c428205ba7

SHA512
94f0f2acdf98626c64e741353f372c2f1f97e55251022c88448cb6a4fb90d5475634344b48f8d00550bffb066d625dcc62e8a4c3e542131138bc13373ed5b5ca

Download Submit
memory/2524-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2524-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download