08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77a0d9c8ac29df3229cbaa9738f77340N.exe
Size

80KB
MD5

77a0d9c8ac29df3229cbaa9738f77340
SHA1

e120df75e837a84a532af69162306968c22a1ea7
SHA256

08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508
SHA512

dce5e7aa2a97df7cafdf56ba230fafadf75334eabd27d7fcc1a2a5189a73c87cc4745a473b9d89a04eeb392d0dacdf4e97fca5d9067ebb7033a7cd25b9a30ad2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTj:fnyiQSo7ZP

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3266) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2488-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0012000000015ccc-2.dat	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/2488-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77a0d9c8ac29df3229cbaa9738f77340N.exe

C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe
"C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
80KB

MD5
a0dec44645bb86ba6980fda62d0cafc2

SHA1
2812005381f4264c8ae411f9c3dc8e287d7a5376

SHA256
056f5ba135c3cb52be3304ebead93010981be6c103ea0be4ee102d6d0c730efc

SHA512
7b3de7cb45ccc26665482468a4fb40701d6871dd2faee72b5c5979461572b94db9af0485e7699628f8566ad3075881476cd0b1d75b9f205066cb7592ac47957c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
89KB

MD5
919c9cf5ff46b1f21db98bc2084f2a15

SHA1
9de14142c47e571667dd7bed6c9da9ae3983422e

SHA256
cc7fcc0a1ac830808e5105926ba5b3305aec4ccb29a8787eb663a0e9c6c08eba

SHA512
a4b00ed17fe66ea349aace43b2bc68d1b191b8bbc617cdffb4308e7419bddc6be1d4ecbd65d336e642395ffa5c431a90e742701a16ed7e98c3677a07bf8a5d1f

Download Submit
memory/2488-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2488-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download