6505dd3e50f9fe8c4ddeac13840ce67d0bde8c991331bd30fd94d3cfffe99255

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ed70b101861a208d38dcdf14b43a70N.exe
Size

40KB
MD5

96ed70b101861a208d38dcdf14b43a70
SHA1

5878701a25331c9307bd6e1d3f4bd0e4117d9c5b
SHA256

6505dd3e50f9fe8c4ddeac13840ce67d0bde8c991331bd30fd94d3cfffe99255
SHA512

85e90bc1ace44c624b912e2d9a267d1411f49b7a37550c86a68dcaf240fbbd9c3f6012bf4d34fae06ba0ff1f656613fe6e81a76cda4cb9487ae86bff42656443
SSDEEP

768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OSbo5+Oi6Jfo5+Oi6JvEXBwzEXBwz:CTW7JJB7LD2I2IbSq+P

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012281-2.dat	upx
behavioral1/files/0x000f00000001045a-6.dat	upx
behavioral1/memory/1956-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\ExportSync.rar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	96ed70b101861a208d38dcdf14b43a70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96ed70b101861a208d38dcdf14b43a70N.exe

C:\Users\Admin\AppData\Local\Temp\96ed70b101861a208d38dcdf14b43a70N.exe
"C:\Users\Admin\AppData\Local\Temp\96ed70b101861a208d38dcdf14b43a70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3502430532-24693940-2469786940-1000\desktop.ini.tmp

Filesize
40KB

MD5
dab86ad1968e3bc19d64712ee201f318

SHA1
f10d042bea4f3fc85ae612ef54b2c71db960600f

SHA256
dddacc91a295ab3f842284c7ae2658db1494e48ad4a06abf1c7731c21cbb5ac1

SHA512
8fc921dccd47c47dea7474ca03e94aa2e0d03bea0af847f5c7779e94a7079fa9616fe7fc00126c7809576c04515284ccfde9e9a66a9cd95fdc456df4d2bf82f6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
78441086279dd0876a71a39a0fd63418

SHA1
bb8ed0f63f36198c3b38cd1f2efe4579aaae8511

SHA256
064faf6091bb4c67c9ed5e3f351263ab032f59bdf569bbda8611df4ee847b212

SHA512
87329256a2097e6473707763af7a2683b3a41cd82cf7c417aabedeb0b62ceb34ed6944a05ad98e6704ea69fe531b173c1127b25cc5419dde92d5eec54ef2cd81

Download Submit
memory/1956-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1956-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download