4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
Size

32KB
MD5

235a8e79ec275108f39af14c76bc7f75
SHA1

6256b4fa6b1a7b5bd1c17232734f378ec708a464
SHA256

4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143
SHA512

68074b3fce0eff6d9a9bb9dcabad7e5411ff4f0c87d779023a225dfcf4b5ee9b274c6ae8b950975b801d703b28ace4f580863bad8b6fcf65283bfe4cf9176910
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ59ADJsmrPlHlB:CTW7JJZENTNyoKIKMmrP1T

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012267-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2332-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Defender\MpClient.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.XML.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\ImagingDevices.exe.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\SpiderSolitaire.exe.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\es-ES\Sidebar.exe.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe

C:\Users\Admin\AppData\Local\Temp\4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe
"C:\Users\Admin\AppData\Local\Temp\4a57ebe72950328367e4a7a96fb7be6489bb9ad4ce41a551c0fb04defbed0143.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
33KB

MD5
7e0e4b1ebb4db9298105b68306d8be97

SHA1
cc9e27a4ee22e997577db3e7cf7fabca7e697620

SHA256
c1c0df99a811c4861adc135b268130e7c692806661adb6d406b32c0b1b26e1ea

SHA512
011f3ce01ed37b46d7827231d436aaa6aa4b43c228f58b334edd19c8b42dba4dfa65a25a912663fcb1a0038d61059d0fd3e7ec9841d72dc323ff829aa80f24aa

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
42KB

MD5
b6174ac752d887bbfacd2c084ed48e00

SHA1
d16f8ec381a167c982650f24a7695df32cdc94f2

SHA256
1006748895cf22ebd02e87dd939c8d454ce48a8b6929303e0486395a9948c22f

SHA512
70444d55f221b88b434a4ec7b323f1f8bd00b43af3397886d6d73bbd5f9a95e28554c5f9c9c968811dd8c433f5d9f9b5383ebe18f3dd2901c65dd57c93d47d73

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download