55b4b82d0551294860d15d9d5d0e15d39a68e55d99ea5af5f0ec78aface3b8f0

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 04:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3c0c60febb94acb94c8315d27f60c50N.exe
Size

34KB
MD5

c3c0c60febb94acb94c8315d27f60c50
SHA1

60e3a49cabf4f53b8c181189e3ad6d567d791009
SHA256

55b4b82d0551294860d15d9d5d0e15d39a68e55d99ea5af5f0ec78aface3b8f0
SHA512

9ee27bb9948b794f23b9a5b79946905b5f4fe53a6f06346e17899c134e4233cb435035b5baa84f3a0bb4cc022ef1312c4b714aaff077d7c4abed0fffd7ec11fc
SSDEEP

768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OS1So:CTW7JJB7LD2I2IbS1So

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3461) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a000000012280-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2188-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libequalizer_plugin.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Maceio.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\ExitSwitch.cmd.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	c3c0c60febb94acb94c8315d27f60c50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c3c0c60febb94acb94c8315d27f60c50N.exe

C:\Users\Admin\AppData\Local\Temp\c3c0c60febb94acb94c8315d27f60c50N.exe
"C:\Users\Admin\AppData\Local\Temp\c3c0c60febb94acb94c8315d27f60c50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
34KB

MD5
e58e8cdc54c890d222fbef39a11a00a9

SHA1
a4463c37363194b7a9406bf635d0cc765b34c18b

SHA256
b707218abf327117ecb401c5287b1a04df44205d1b38aa33ff7818805a753079

SHA512
7367cd671a440c68545adeba7a7deae9f028f2be611508153ab72dabb3901ceb0f7b666243d3552d244ea538826b26798e4a4f8e4d5f48b3561553861530e61c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
5e2f903b8fe30e00394a018cf2c22c1b

SHA1
12ad1779280613a4afb9a44abf803612a336bab6

SHA256
5089e015230fefabab1cd7702b4052cd0a04421a74c60943ba81a3c910033078

SHA512
57b096566ec98c6831961ca381a2ff9f8c59de42f65fbc2b1a38cee630beab84855a2cd3422cff7a06b4e4835a8ae7095dd8fd7196f75096545c757c4d8bd1b7

Download Submit
memory/2188-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2188-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download