8078f92f571daf0ca0cc20fd9f315ca11563fed89bccb3f7dca9f78fbf87c071

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bd03ef4f42b221c088ba161e7b947f0N.exe
Size

29KB
MD5

9bd03ef4f42b221c088ba161e7b947f0
SHA1

893d809885bb6f355c4abeebc7a31876675883a4
SHA256

8078f92f571daf0ca0cc20fd9f315ca11563fed89bccb3f7dca9f78fbf87c071
SHA512

ecdea8e69fd2b6b62402d9f2f2461edc9e60211844382d16926ae9463f9e48bd664f2cc8518f5c45eae139a60487ec1108b1a1b4302c6fdf1e7ee4792882dcd7
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATB/yNhPn0DPn0n33:CTW7JJZENTB/oP0DP0n33

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2668-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00090000000122cf-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2668-71-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libchorus_flanger_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Windows Journal\Templates\blank.jtp.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bd03ef4f42b221c088ba161e7b947f0N.exe

C:\Users\Admin\AppData\Local\Temp\9bd03ef4f42b221c088ba161e7b947f0N.exe
"C:\Users\Admin\AppData\Local\Temp\9bd03ef4f42b221c088ba161e7b947f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
30KB

MD5
5641e9df581ac48d7aaef8c576ee2172

SHA1
7c1fed359166258a1789e6b913f84e3229416452

SHA256
b968cbcceb368700dd574029f2a5c88fa877dbc67465dca2d4b333e1b8f6e1dd

SHA512
5bb9654dd2e5263d11e9be767cf047fbb2dbb3495bb58774679cd244d88df07f173bcded628360e79d5f9d415cce56b9e1c117239500b1d9805f619a53a26244

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
39KB

MD5
31f6c319b739a241bff1f658fe9a9f48

SHA1
ecf6eae528c2e45ac2f5c08dd297a457e2109a0c

SHA256
7acd502b9af5db892457b95b0fe608986b4262b40b606c329c6f2a8834f3d00c

SHA512
bfeee4c60a84fc85f5ebdbda648af710c19abd537989a3bfcb1d75e2b01023cbf576b94f86c63cfc926f3f6665ff16590ce85e9c707880c2aa41e1636fac9f00

Download Submit
memory/2668-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2668-71-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download