9d9baef530027e2be7b80279d8d95393a1c45b47849e851c759610e85627c81a

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3ebdf27d80a99ea8988060c4c35a4e0N.exe
Size

38KB
MD5

b3ebdf27d80a99ea8988060c4c35a4e0
SHA1

4f2953a7b03d994b0c153687ea4f956f5f124254
SHA256

9d9baef530027e2be7b80279d8d95393a1c45b47849e851c759610e85627c81a
SHA512

077a30209b9165a9108ad181176ba66a558378bdc1e2a5bb48698f3aab75e148aaffea2f0ad1b3c72237e71f65b646740f0a3984762d7e0e0b6b7f17a8edefd0
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ59ADJsd4C:CTW7JJZENTNyoKIKMd

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/memory/2780-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2780-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Windows Journal\de-DE\Journal.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Mozilla Firefox\platform.ini.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3ebdf27d80a99ea8988060c4c35a4e0N.exe

C:\Users\Admin\AppData\Local\Temp\b3ebdf27d80a99ea8988060c4c35a4e0N.exe
"C:\Users\Admin\AppData\Local\Temp\b3ebdf27d80a99ea8988060c4c35a4e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
38KB

MD5
78744aa5960f139339d6ece8b7c66ee8

SHA1
37b8c2ab2e76ea8c0f47b8f484d4634e871e17c5

SHA256
9e8ea7382f63580b63b34dae8d48b64fe23790355e1e4ef78956da4a70e08a29

SHA512
e381e702f285af7770ad74eca64029f623f0b7e1ea4e74c0d6df5257b018e17eba56472a3c2e5ed1d31bedfd933f00fcfe5d5bb786353d8e395b782a3a5e8c67

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
47KB

MD5
ab5212339d666e9b1c322aae1720dbe1

SHA1
8297d059c0b05bd0cedf314553e1f2ee0f527a14

SHA256
20a2b8690c04a29c621f87882a45437e2a000b5fb7c77a604d875e17a1d1919a

SHA512
12677fac8cc26cb94570d520bc24308e971160a643f63f40d426f7da2c1da8dffd05a1b522eaa634c6c5fb15ac8ec3eebe9eda93f343771c29b0fffe48201d01

Download Submit
memory/2780-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2780-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download