067578642afbcb419079faf93833718eb69c4299ab81178578f46cb929472a1f

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

953cc12fe7930af999b1a236ff4a4520N.exe
Size

34KB
MD5

953cc12fe7930af999b1a236ff4a4520
SHA1

218795fdefb9c7c84d391295d61b272ca25aaa5b
SHA256

067578642afbcb419079faf93833718eb69c4299ab81178578f46cb929472a1f
SHA512

30ac09f2fc2334a21d193532f9c64b987bd1fe262278bc0238d5c0c1eee476e944c63a2a97a3a39144a08be8e95c861e3fec39656fc29fa536c5dac4e5dc7792
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBApwp2ZgZ6babu:CTW7JJZENTBAOUY8

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3355) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1800-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012118-2.dat	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/1800-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\vlc.mo.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Prague.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe.tmp	953cc12fe7930af999b1a236ff4a4520N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	953cc12fe7930af999b1a236ff4a4520N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	953cc12fe7930af999b1a236ff4a4520N.exe

C:\Users\Admin\AppData\Local\Temp\953cc12fe7930af999b1a236ff4a4520N.exe
"C:\Users\Admin\AppData\Local\Temp\953cc12fe7930af999b1a236ff4a4520N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
34KB

MD5
3dac98b336652fdb83f9e1daa94d73fd

SHA1
6561350ae0d8204aabdf2674824ba72010a58a0a

SHA256
b0148ce2bf274a8939e2c9f6b404ff3a5a4c3a83d545ef339cad32b85734f6b5

SHA512
d8a14c7e18d32c4265d43d07ffeb8c0c656a88ad5b318f63bacf4f1af5764a76e4d86920c6c5c8ebd2c43c9f7b919eefd26ca7915375238321eb05e862c5e109

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
43KB

MD5
b526026a07c3f28a27aa18ba47200af7

SHA1
caa3fe96909c844da20c581c5af8f6a71eaf7cbd

SHA256
84f12f55d9b79c51f08665919af4ca69b6aacda5d39fb494665315f834615ece

SHA512
f07a0152a5f762b218ac0a177c872f6fe99603d31f26e4f30fdfdfa7783b7c2463d864b2380054bfbbd7a1e811039061d13ecb7664b3234040da761136f1d8dd

Download Submit
memory/1800-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1800-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download