5cafbebcb61bc6fa0b108fcbc955de742cb8164b00b877fe8595795ed741b53d

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9df313b811c103a233498ff7f2c3bb30N.exe
Size

27KB
MD5

9df313b811c103a233498ff7f2c3bb30
SHA1

ea637da2c01e368ace9d537e5f0ac22d99fdedd3
SHA256

5cafbebcb61bc6fa0b108fcbc955de742cb8164b00b877fe8595795ed741b53d
SHA512

3a3db99bbcbd32b0c793ac0d6e9c5783902c27c5cd60d53317d1fc969adcf6353ec7dd9d99a2ad5f6d2056a5e3e458242d099ced26e0cc5d4db79d9d34e37a23
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HxwcFn4:CTW7JJ7Twc2

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012029-2.dat	upx
behavioral1/files/0x000400000001043d-6.dat	upx
behavioral1/memory/2548-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Windows.Presentation.resources.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\buttons.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	9df313b811c103a233498ff7f2c3bb30N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	9df313b811c103a233498ff7f2c3bb30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9df313b811c103a233498ff7f2c3bb30N.exe

C:\Users\Admin\AppData\Local\Temp\9df313b811c103a233498ff7f2c3bb30N.exe
"C:\Users\Admin\AppData\Local\Temp\9df313b811c103a233498ff7f2c3bb30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
28KB

MD5
b2414dfa58d2a0dceb1d1908076643f5

SHA1
8fbde51393da8597290b813228e872971bfc6024

SHA256
5443e6d468ef3518cf07d535f390048a1977c2acf15fd75e8cfaf85a8070a30b

SHA512
03e400d86e92a73fc43557e1abed606f22b9c1485fbf383f99749eb1751c09060fc6786bf4c612fac2855d1ef1128f2c5cfaa2a3205abe7464898720c3e9878f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
37KB

MD5
75e845a20c28450490da8033440d8cec

SHA1
c2993a8c81a4a2689ebc2a960a7b4e70611f98d6

SHA256
f42fe42b9c6dfbb144e629a7633bef4d0918824f6ae77b45214a640c820339f4

SHA512
703b7b68cfb1575092428202e6ac700d04bac8582de3dd4ef79fa61c00e86c581de6c6e0665ba92822b7ce28d6923fa8fbb268dac3aef491d313f04a97643353

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2548-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download