1aa1cad6a811eb2761392a893a61f9759a707bfa68959b9ce09d2178698c9133

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9155d1f377744666176c02953e82e020N.exe
Size

110KB
MD5

9155d1f377744666176c02953e82e020
SHA1

eab41cedf4bba6f069d7bcef5ea8ef20491030f7
SHA256

1aa1cad6a811eb2761392a893a61f9759a707bfa68959b9ce09d2178698c9133
SHA512

fa3c6e8e4cccea1dd725fcbeaf72fabf1f30b526bc2ec73fb6b4cb2d81191159f677dc40e5f9544c0e0f7b1942af82f995f44d6dbfb80d8ee6ae936b6165d48a
SSDEEP

1536:V7Zf/FAxTWoJJ7TTQoQWkjk+TW7JJ7TTQoQWkjkR+C+v:fny1oRVA9oRVAR+C+v

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2878) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1840-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/files/0x000400000001043d-6.dat	upx
behavioral1/memory/1840-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.security.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	9155d1f377744666176c02953e82e020N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	9155d1f377744666176c02953e82e020N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9155d1f377744666176c02953e82e020N.exe

C:\Users\Admin\AppData\Local\Temp\9155d1f377744666176c02953e82e020N.exe
"C:\Users\Admin\AppData\Local\Temp\9155d1f377744666176c02953e82e020N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
111KB

MD5
9856865787d4c00a537d9903c118daf1

SHA1
c2d057f8dfe9da5c11e3eef814f243e297778440

SHA256
bcfda1ec11f9138131d9e5c11afee7fd2545947d3c36cfeb797307dd34f253e2

SHA512
20ef383b84f50e0ef8b9843639fe2f256e963dd4692fd887040f194768b0f7015b5df1165a02f6dbdc18e71a9b37b66f95bcac2794a16371796067753ce301da

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
120KB

MD5
827e7739fab4bdc8263ae5fb53dffac6

SHA1
5930949e189124523ea72bb4a635f6fa60704fcd

SHA256
10a09862a8bef2280a00287aeb94024d6383711b242531c40bd69bbb32dade91

SHA512
73e21482fd238027c97ff3b5e6d274ee1fc76d0b0ae50f436e218ba44d6f71c57fe7d7ffa12ec0c3a3918a4b400835112c4be294d4492bc041be6dc2b6b8a63c

Download Submit
memory/1840-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1840-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download