944527adff4615aca8029f281db119e7e09ebea139987f844cdf0ecbb02c0fb0

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/09/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6758e76596919ceb8095ef0ba2e6f920N.exe
Size

49KB
MD5

6758e76596919ceb8095ef0ba2e6f920
SHA1

77e635e5132369856ceba5a7db7fee6064ba1c55
SHA256

944527adff4615aca8029f281db119e7e09ebea139987f844cdf0ecbb02c0fb0
SHA512

b0b8594d67b3b4f85b0d31c2ed1bd5036581c34deed1d2f9f3506bc6d81e9b80d0cac09fe835b91e54dfbe546fc4b45246ebcb564368f77bb0486120b04ead14
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9bJSsJSPGUGX:V7Zf/FAxTWoJJ7TFJSsJSM

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3341) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c000000012280-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2548-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DebugReset.vstx.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\bin\ktab.exe.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-5.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-time-l1-1-0.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d11\libdirect3d11_filters_plugin.dll.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	6758e76596919ceb8095ef0ba2e6f920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6758e76596919ceb8095ef0ba2e6f920N.exe

C:\Users\Admin\AppData\Local\Temp\6758e76596919ceb8095ef0ba2e6f920N.exe
"C:\Users\Admin\AppData\Local\Temp\6758e76596919ceb8095ef0ba2e6f920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
49KB

MD5
1f1bca959bb036b65f18caab31e80c35

SHA1
974ab3492d2ef0a45bdfaec1162b8e009072fadc

SHA256
5a828961bc964fb4779c2835754ca41d83e4e2dc2743f977947a2dc889504681

SHA512
d4c70c1f5c7cf87786f9913ca52d48d44f57c40438fef336b74896985e78cc7d62af169cdd7ed9e5889477ed64d1fafa572a16dd5599c0ee7d5ba456273ff569

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
58KB

MD5
2663a57ddfb9b7ae57b12d38a26cf3d6

SHA1
4b95cedca5c1651e0f083d4fb4f0e503cc859ed2

SHA256
3ffe122025ae2c79b615b56225ba291db80163418d5216bca74030cc82111e4b

SHA512
7323c030c4e5721af6f24788e616888605b35dc16b99be3c4fcd685cf536518e05a6a4f387c3e9fd13215b5b4853b51f860ec0952d274ef5d121cdd04a506d2e

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2548-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download