5d75a68cfd811444f891eb89908c18578d8f27e3e9e36dcfd13aedf86b474664

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
Size

64KB
MD5

14e26f6a39ebda6e4c26e60ae85b3ea0
SHA1

00d72ae786869ce7d8e525652341025cfecb112b
SHA256

5d75a68cfd811444f891eb89908c18578d8f27e3e9e36dcfd13aedf86b474664
SHA512

b8be1401813d86b5e9196dba81e554dac1385e92acd76e8ade7011ebde748bf40fa87bd4e837733c429d9a461848df2cba13d1a2b6582266bf3da8af47409bde
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzu:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5Kbo

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3307) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b00000001225e-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2264-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Accra.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\desktop.ini.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14e26f6a39ebda6e4c26e60ae85b3ea0N.exe

C:\Users\Admin\AppData\Local\Temp\14e26f6a39ebda6e4c26e60ae85b3ea0N.exe
"C:\Users\Admin\AppData\Local\Temp\14e26f6a39ebda6e4c26e60ae85b3ea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
65KB

MD5
d1fec7902ad48a97efcbe27b6cd677a9

SHA1
aace2f97d41e5feed40bb723acb9697709f0fd65

SHA256
d719c05cb250dca0a08b3a261f8c04946c4f761094327380314839bc7b4485d0

SHA512
3025b178177cb05742e56c65fd356d27b7e76e9c863d78acba60701e8e7d81423388bd0484d2b0b46e1ce9c0b60a5b3072d3e56088bb2cbd3266cce5f57bc393

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
f616e5375ec28b242a5c889d8bbbceaf

SHA1
3fecf9c4ceb6e5567cf7896dde37e75c19ecad0b

SHA256
5a8dcef5a536f4446596a03096527ed406f033fe985855f51cdad10725bde6b7

SHA512
beb320920fee4b594e534344d2719a87162e49e2e318673f762b3750b8dd2e962bf01aef977b6950e76b90dc8fc3de68c5653eaac2d2d974fd4d42588cf210e6

Download Submit
memory/2264-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2264-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download