e702a4a9e1f64386cc506df051aadb79b36983caaf15b387d9d422a42bc8cb4c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e18d133efa26fbf469df238cb8006b90N.exe
Size

60KB
MD5

e18d133efa26fbf469df238cb8006b90
SHA1

24a5f4dfe8787b7db681731a86604e157259e24f
SHA256

e702a4a9e1f64386cc506df051aadb79b36983caaf15b387d9d422a42bc8cb4c
SHA512

2c35adf2faef769e78640b1eaa068c5fc0f1d45e4dfb33b75f8d6cb4f6173cc8de6a6d56b30bf20156120ad56fb65d9f170969c01563e102ebbc9b8f4f840059
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5+K2IkIA:KQSox58IkIA

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3222) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f4-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2104-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-3.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libscreen_plugin.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-progress.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	e18d133efa26fbf469df238cb8006b90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e18d133efa26fbf469df238cb8006b90N.exe

C:\Users\Admin\AppData\Local\Temp\e18d133efa26fbf469df238cb8006b90N.exe
"C:\Users\Admin\AppData\Local\Temp\e18d133efa26fbf469df238cb8006b90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
61KB

MD5
a5a61b6efffc83425ca57efc71d267c1

SHA1
478381b2b288d60baf79699e2a09581fdc8eb0c3

SHA256
17208a1a6527681b6c807af4754578c246d6f1e9785b368f301deb1bb679c601

SHA512
f67765bb767eb54b0f09ecd8d48163f95e09d1d054cd5cb34f6d1891226683d03e235b9c9371a96f5f5a2cd73a10e41c17e0dbd3dc0f015c9a667b330842150e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
69KB

MD5
8aec9cb6c6d631028a5fc601d52d7af7

SHA1
411f5121c4100608a460467c821dbd3b7c94cfb5

SHA256
8bc85fd4bf8ff76f9d9e30ee4f69812827a316f62c3f64267d79be886daa5273

SHA512
712ec2d0c39570ceedb3fc5953da1bec659275615bc293541b64541937194ae18ffaa46cc4fe814c507e058379bf3e65997c8c6429823910b43165612e3bc10e

Download Submit
memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2104-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download