7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
Size

68KB
MD5

249b829e2d0b68ccca8d0c9f868c69ea
SHA1

426de58e5893d501ada5338b27d142ba874f06a3
SHA256

7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503
SHA512

7ccee9b4cba3e8903731d34ff8fa786145735c663d9766af2763bafeb09307e239c4227d40c009fd87dc7c4256793454d018db6e8a86ba5c4c2cc453c6d51d88
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54wWR:V7Zf/FAxTWoJJZENTBWv36y5H51

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120f6-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2316-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.sig.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jre7\lib\management\management.properties.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe

C:\Users\Admin\AppData\Local\Temp\7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe
"C:\Users\Admin\AppData\Local\Temp\7cc2e8e2d1acd617bb7b12b9c27f0571db446cfec51061a78132fde6bd06b503.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
69KB

MD5
41c17fb410caeeb3abab39376af91792

SHA1
b8979080a13756413dcbc543e569c78c7a9f8adb

SHA256
eebf17384d85823723b5e5622a6c1b4161bd52610e4248a1bc6a2e7f89e81bc3

SHA512
eed8e20a8a0d0d1e1fb4768a4acd1a0a1194887cc822f66ed414c135944a76f28ec8de43d60d604c243a590bb47fb8964a03faad86352c1977818037c082fed4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
78KB

MD5
26dcce0704735f326c80d689fe4686fd

SHA1
a3dbbd9c506f518619a010dd449b320b3e9ff5a5

SHA256
8ad3030dbbeb706c96b1f6f15e319503c55061d72904c33dae057ff5ffea903c

SHA512
233ac7a861722f97b173e802099cc1f539d7526fd4c09327f02df1ae5507794cff4f729bd53e74d28f8284d3234d5a780cfc461ccd0501003b3fa3738e50c16b

Download Submit
memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2316-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download