3794aff83e8e55b20c0ad50ccf2101505e0cf8cb50aec713b073a02dc0486752

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d6ab1a351638549d90236198c8de480N.exe
Size

66KB
MD5

6d6ab1a351638549d90236198c8de480
SHA1

3f87dcd3c810c3c70a23de712bac503aeffd3f24
SHA256

3794aff83e8e55b20c0ad50ccf2101505e0cf8cb50aec713b073a02dc0486752
SHA512

e8684bbcda9bfae8c755fac203d2bda0835138bdda65eebe62cfc929ba91415bea2ee3db661f211a69deff3e8eaf11dbe294e2fbf114b569e46786fc18cd50b5
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5NKZDLKZD3:KQSox5WDgD3

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2842) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2064-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\README.txt.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	6d6ab1a351638549d90236198c8de480N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Rarotonga.tmp	6d6ab1a351638549d90236198c8de480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d6ab1a351638549d90236198c8de480N.exe

C:\Users\Admin\AppData\Local\Temp\6d6ab1a351638549d90236198c8de480N.exe
"C:\Users\Admin\AppData\Local\Temp\6d6ab1a351638549d90236198c8de480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
67KB

MD5
c6d8a24db3fad11fa97aef9b559e66c9

SHA1
85ecc8eb6dd796e99cae770a47cb8e99ae212a04

SHA256
4986bd787a581b9e3bbe25651e106da13c1bc5409f6f6713f67d97533ff8f3ed

SHA512
8eb015532bd7a0695b1bd6cb34de104336013127dcb9f7e7fbbbfbf8925385f7b8013293806f8647e02cc0803837f5a726e4fec14500225e915e5bc9c415cba2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
76KB

MD5
5203e55d4b15170c11116a19cd9af992

SHA1
5df0266c39aa2895b4db8cc0c89237776cc980b8

SHA256
7b0a28c84b71c2b75147ed62968f47c8fcf61d037e9d811343f9e3b039b06113

SHA512
c4e4bf19802a9abdc5fc57cb7af857dd7ebf5bb952d9f95537f2b3d5820b66cae8ee54dd0b02d00b44975dcc3fe2d4f0fe146fb11e54bed76cc7bfbef2d5c2af

Download Submit
memory/2064-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2064-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download