f0fae3ba80686d25a62a2dc60043908de4d50e20a1ad9583cde5e6ea39365464

Analysis

max time kernel
120s
max time network
22s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfb619759278fd09cb886a0dceb6900N.exe
Size

49KB
MD5

7dfb619759278fd09cb886a0dceb6900
SHA1

c772145005f5c7f7df8f29c117b5cb56d42cce7c
SHA256

f0fae3ba80686d25a62a2dc60043908de4d50e20a1ad9583cde5e6ea39365464
SHA512

85c6f87600d0c1b7cc5140af98bb500b3b205dafedcf24106bbcb327e3e3a7b05a6140e09a14c5568182c913aa2203a90e07d2247e4361a1db46c1e50550caa2
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdy:CTWUnMdyGdyoIOIN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d0000000131aa-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2332-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-progress-ui.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\bin\jawt.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dfb619759278fd09cb886a0dceb6900N.exe

C:\Users\Admin\AppData\Local\Temp\7dfb619759278fd09cb886a0dceb6900N.exe
"C:\Users\Admin\AppData\Local\Temp\7dfb619759278fd09cb886a0dceb6900N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
49KB

MD5
877aa0882cccc212eb1db313565ca10e

SHA1
52472591da4c2077d617b5ac99ddfa92dc354263

SHA256
7a13010c3de9ae909ec642293d9457db8d777f4c6e5b4ed6f36db366fd805579

SHA512
10452a448ba32356e7fcddeffa0db89c162d4b05b843296958fa1ad37e823076b6df05ed8e27d07e4dfc2877a392f83493ac3c88b60dab224a7f7967a38c04c0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
224ec490649aca88a1ec4c761fbae6e3

SHA1
8ec81e130e10c55b3019b877885dbf631da66ebb

SHA256
e4f9eca8d2ac8eb70d614df2bb92553a6f130f2fe82dee82a4f4ba4985700a1e

SHA512
4dbb43cca9958b638fff74d2112888c7efa917fe87e069eed306003d563bb3c035f04e9da80eda72bdfe392971e6d0e8d731d51941b9e659c106f585100af969

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download