bc42a08b81fdefada23fa327e3c601023d2010d280eba9f407885d9f8e65372c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/09/2024, 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75b2717b798fa936f64b34dcd90ab180N.exe
Size

41KB
MD5

75b2717b798fa936f64b34dcd90ab180
SHA1

c5dd0e3f294f764159da41b55ef5798efdd40359
SHA256

bc42a08b81fdefada23fa327e3c601023d2010d280eba9f407885d9f8e65372c
SHA512

19f5617d91a3f0b78eff54043b23235e276d129ab3c974314140ab5d3eeca5a24176c798c7204a044c617e4a0513ce9f6b7958e76c623819e998944c51a2ccd4
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti/r0:CTW7JJ7TTQoQ/r0

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3419) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120ff-2.dat	upx
behavioral1/files/0x000400000001043d-6.dat	upx
behavioral1/memory/1732-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychartplugin_5.5.0.165303.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\ReachFramework.resources.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\JoinImport.AAC.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\BHOINTL.DLL.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	75b2717b798fa936f64b34dcd90ab180N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	75b2717b798fa936f64b34dcd90ab180N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75b2717b798fa936f64b34dcd90ab180N.exe

C:\Users\Admin\AppData\Local\Temp\75b2717b798fa936f64b34dcd90ab180N.exe
"C:\Users\Admin\AppData\Local\Temp\75b2717b798fa936f64b34dcd90ab180N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
41KB

MD5
42e05fd1ecebe40b72b74c908d75eee9

SHA1
5a0159e237977dd7c594c110ce6baa05535f8f67

SHA256
4c4ac7f2258141af54e91cfd6743f034310b105947c39b2a7e1dd91f516389be

SHA512
9bab7f2ed43c7b3038a245885c9f0639eed6e43e45580b24a186715dab94fb87ba0dcd9fee727efe2198a78f706879926bd049aec6714a690283994a3d44e277

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
2373d48740f66a9e7ffc6d7909c4b9dc

SHA1
16970c017caff09b5c8f828e574fa7e6ed830194

SHA256
4bfc26319beff1240344b2b9729ad96b92fff9d15247953d580ab7f09f8dc8c9

SHA512
9aa097e9a4a56ccb05f42898c4c106f02d0bc6cab1e24507e134170f8a50d7057c2f33f102d4ac21f0bc23ea3c4a35e4de27592be7b62382c9bc579c1996bfdc

Download Submit
memory/1732-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1732-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download