3fa08a9a4a0746ab3a4fa589cf60a804e3167cec3f03ae93f5f945fd5660f979

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-09-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4764a8f4c56a61a52ca533c86c0860N.exe
Size

98KB
MD5

fe4764a8f4c56a61a52ca533c86c0860
SHA1

4fa4c97f83131f89c48efae6a4725b31cabd11bf
SHA256

3fa08a9a4a0746ab3a4fa589cf60a804e3167cec3f03ae93f5f945fd5660f979
SHA512

192df96ffda6d7268844e7faee499cfa0a41773c3cd7f3c31ac57e7e04d1561ec6aa18282f6ccaf7b59d1a327a94e43f22853a7bb60e401679829fd7160b53c2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGl0Q:fnyiQSohsUsUK90Q

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2950) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012029-2.dat	upx
behavioral1/files/0x000400000001043d-6.dat	upx
behavioral1/memory/2792-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleHandler.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\chkrzm.exe.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe4764a8f4c56a61a52ca533c86c0860N.exe

C:\Users\Admin\AppData\Local\Temp\fe4764a8f4c56a61a52ca533c86c0860N.exe
"C:\Users\Admin\AppData\Local\Temp\fe4764a8f4c56a61a52ca533c86c0860N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
98KB

MD5
efda7d45998cd2628573ddbd88802380

SHA1
45d2f083203afc9441ee19fac02e54397734ec97

SHA256
4f3fd8419980a3948ed7eb29584fa212835c04254e97ebc2500ae04728a2242b

SHA512
e8e5883699b820393345471f9a8645b1f3c873d2f94487a63a76c64c436d96ab907077bab35cccd55771de483df040bfdcef211a1f1e3a7f7eaeac6ab52edffc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
107KB

MD5
8ee0221f7adb9b520596a26cbda67343

SHA1
08e43e022b8989175c1ac5a7d2c1defee2e5fad2

SHA256
edc27bd810c543f560beb27e3bc8cfa9ade919f262f8d063030eb78bec0d015d

SHA512
25d519eb2a8bc712ea34a40ce0f056e6aa6bf65ec1c98d256a5d7eb619ac9df47bb441d30b4629ad49ab6f7e44a270d1df4b2a188ce2a51d08da9462996f585d

Download Submit
memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2792-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download