9adfa22eb46865688c9ec41f5b2ef2657ce130a65eb925a6ff767ed9f8fcf1e7

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

776cbaf1ef420394866d1d5f592db710N.exe
Size

76KB
MD5

776cbaf1ef420394866d1d5f592db710
SHA1

f63b9350592ba71240bfd30002c6b2e5c7511949
SHA256

9adfa22eb46865688c9ec41f5b2ef2657ce130a65eb925a6ff767ed9f8fcf1e7
SHA512

07aea0d77452e0306f0f1446621f717f91d550f66d7d1fb5500b21accfdd56a0b01bde6ab341ef0aa0906dfcc39e8725db3cf01d2f1204492980717d2848ff6a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9woOzOuiJfoOzOuiJpBTp:V7Zf/FAxTWoJJ7T4M4TW7JJ7T4Mc

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012280-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2192-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\EnableDismount.xlsx.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	776cbaf1ef420394866d1d5f592db710N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	776cbaf1ef420394866d1d5f592db710N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	776cbaf1ef420394866d1d5f592db710N.exe

C:\Users\Admin\AppData\Local\Temp\776cbaf1ef420394866d1d5f592db710N.exe
"C:\Users\Admin\AppData\Local\Temp\776cbaf1ef420394866d1d5f592db710N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
76KB

MD5
61898e7dfe213a67edce4b728de3d16d

SHA1
766964a6e54d17f1110edc89baa8f6c448c2043e

SHA256
a56a4364a6ef2354c8c6aaacd49c9fe44281f922fc4dc967c9e9a7a4458cddcd

SHA512
bb04be1b5bf9d16b8ae93a6c207ce805246a4b59311c28c6177760c8dbe56817228adff5fb54f73b39fbace627149b73aebdb3692ae9044f7e7f1e7eb418f989

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
9dbc50097dbee62d8a89c28c980fa0bb

SHA1
dfb5ff20fe9316f1f5b37809ba7eb43593139ba9

SHA256
4db1e63fb8db7415a89629bd7c9c2df33434cd3f0fb5d44d0c613c8c73bd0c39

SHA512
6d7311926b03c69a12fd4c276f68fa938035da3c0d0a8180b71903bfd5db9f1dc8ec437786f2eff3b34e908a92f53a8a225d8641c538404e43df527c06bbfb01

Download Submit
memory/2192-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2192-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download