17a7b519f40ad5fd1d491fa8e5ec389858d0f66a3174eecbc6019b510ba669dc

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa61d23f7cd7b0594f6942fc3c8be80N.exe
Size

70KB
MD5

5aa61d23f7cd7b0594f6942fc3c8be80
SHA1

ee3a928074ef18b0c3eeb61072a3d40df3c219f1
SHA256

17a7b519f40ad5fd1d491fa8e5ec389858d0f66a3174eecbc6019b510ba669dc
SHA512

809cc43c7444f2b4cf005ddc39b3c54ed72b0e19144e399aadae8851c98dca8b42d7b8445cc0009b066df7e5bda08e86f8bbfa8374cad739af3c3d8e19be62a6
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rO:V7Zf/FAxTW5e

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2816-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/files/0x0002000000010664-6.dat	upx
behavioral1/memory/2816-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\ShvlRes.dll.mui.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\VideoLAN\VLC\COPYING.txt.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\RenameHide.bmp.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp	5aa61d23f7cd7b0594f6942fc3c8be80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5aa61d23f7cd7b0594f6942fc3c8be80N.exe

C:\Users\Admin\AppData\Local\Temp\5aa61d23f7cd7b0594f6942fc3c8be80N.exe
"C:\Users\Admin\AppData\Local\Temp\5aa61d23f7cd7b0594f6942fc3c8be80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
70KB

MD5
13f3203215c0d4643599d9347f64bc69

SHA1
a4f762098697e0f6d0b1aad835dae744af256a07

SHA256
462dbd085cf4ea8eca140dfa81c28e43464041cefdde17be0865b7483b6f77fa

SHA512
31d2028d72fb085d759c513425fcbfc858af54edade617edc6bb03f4090c5a097a0add5860414ee2710ebc273f20ba67ff4616952547e9b96053fee7c343cb35

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
746aff114eda706bbdb0fcf4923fa85e

SHA1
67b0f70765ba41f9455a76599230033370f1bad5

SHA256
5c46581ed945f82fea3ab47071ec235b5c1a59fa0806a16698bae1815ff22af3

SHA512
7c28df07deff1a9485602b41ea81b3383bc55d205c083959864f5dbd7adfa6026dc60b47861e4bfac52da7f97c65815b6d79baf71c11bfcfd06b80a4ba876087

Download Submit
memory/2816-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2816-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download