0b2b1291bf52482f2cb3b56cb919775b07d5cbd61363427183f386828cbd79c6

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
Size

40KB
MD5

f288f768b07345234b5a7665053bb587
SHA1

edeadaf50e32160ad6b3ef65664c502ebeb0f4c6
SHA256

0b2b1291bf52482f2cb3b56cb919775b07d5cbd61363427183f386828cbd79c6
SHA512

131eacf2d185a6694ae602f054f30c4b046d24e1624cda7a5bad4639f6a51b0aec1e33bfcde6f9903194f1973c1054280faae26f7ac1e7a292a62079231b6238
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiISKSz3D:CTW7JJ7TTQoQIRU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2945) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2756-51-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\SubmitSplit.ps1.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_f288f768b07345234b5a7665053bb587.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
40KB

MD5
056623aa6b6d777cf332acb6606d3e21

SHA1
7274b2eca0bb4d9ee16575bc3417926fea535594

SHA256
e580fe732df7bb597226ed1532a2ecd6e480101e19b1c1e2ddef00b424445705

SHA512
85e298d60e85c52c80b526ac1fb9f45f0d9b9287b7b9edfbcf63bde15a3e8c0f2ec551ef83f141bdf638d40c52e3cf25feac4cea8dd6d6b91630937101f5325d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
49KB

MD5
34a1fa68c3c85e3837e09ee82cea5438

SHA1
75194c5916b95dec8b3d3ec4b2d99ea1876306af

SHA256
3ee3961db3ad9f32add74df37e32a707ad4a441ff3584568b0abbcc311e54f23

SHA512
bbfa92c31defe46c669c167d487776bd9b99abf3ca69b968c524010eeb4bfa96aa442485dbae5f7158b5d0bbcd03d87b9f8b76bb8b2217d1652852b6b8d6742e

Download Submit
memory/2756-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2756-51-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download