ab40be16ed00d91403f511b38f32c888489fb351779d4c1c1ad554aecf3e053e

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd2512db7ffc44eefcf2124d15d5aef0N.exe
Size

1.8MB
MD5

fd2512db7ffc44eefcf2124d15d5aef0
SHA1

5aaeb4896134b3ac42466541b453d82fd680d166
SHA256

ab40be16ed00d91403f511b38f32c888489fb351779d4c1c1ad554aecf3e053e
SHA512

8dc11ba51aaebbff2ed6851f1d7eaa7f693751b7b76b8a6233cc4bf2453a710fa5b6e1b632cc20d1e97f350b8b847896f8095f2ac2c2813c31273b7411e5c5c3
SSDEEP

12288:TncGwtIR0XEybX/aqvHIzckUPPyiwRoVGwhGARqOB:TnTjR0Uy7/XIzck0PzweFhGuqOB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (233) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0005000000011c2f-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2480-54-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	fd2512db7ffc44eefcf2124d15d5aef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd2512db7ffc44eefcf2124d15d5aef0N.exe

C:\Users\Admin\AppData\Local\Temp\fd2512db7ffc44eefcf2124d15d5aef0N.exe
"C:\Users\Admin\AppData\Local\Temp\fd2512db7ffc44eefcf2124d15d5aef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
1.8MB

MD5
282cdc0efa9d405fc92a856dc2212526

SHA1
d75fbe3389ffd89762d78c758117c3dd64c44c33

SHA256
9778bfa3ed362b94bd5c17f98d469dc20333ec2862339b80ab0885ff486d62f3

SHA512
b019668b003f4da6c5a66c6e8810327b6627c9c18e33dfe07f0474d88262eaaba0176ae195807a7ab5e398ea3470442c83f5e9a33fd3506cc8120e593fe1eb9d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.8MB

MD5
8713bb04aeb127534230bb2fbf00fb75

SHA1
f89ab11998e4dec313191e74b5b24e8fb906561f

SHA256
4438ed06907ed354ea209bd2a6499a503b356e21bc91b821135e85563b8f70f7

SHA512
cc0c4ebf47a0fd07d6067386baaf4f1361571800e34716069e87692f04f7af84cacd1664cbc4b8ef2cc680bd713af4485ab0ee6ec7ec5d8c812aab5d5c85201a

Download Submit
memory/2480-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2480-54-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download