513787e4e51131458ccbb67718681ed8ac8458def7429605c0b4632986af9391

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd83c6e029a3f4e456aa738538f3f3f0N.exe
Size

37KB
MD5

cd83c6e029a3f4e456aa738538f3f3f0
SHA1

3dc17d57ef193e757632f19b2c05b4d064571738
SHA256

513787e4e51131458ccbb67718681ed8ac8458def7429605c0b4632986af9391
SHA512

bdf8317ce9080b4cb348f48b3337da8d03e5c35b05f6cc8d1a858c84e89e024cda7a70514e0277ad219ba5cf670707964d602e67615b550d953ee4b902075134
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiX0eR:CTW7JJ7TTQoQkeR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (469) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012256-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/2376-27-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\ShapeCollector.exe.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	cd83c6e029a3f4e456aa738538f3f3f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd83c6e029a3f4e456aa738538f3f3f0N.exe

C:\Users\Admin\AppData\Local\Temp\cd83c6e029a3f4e456aa738538f3f3f0N.exe
"C:\Users\Admin\AppData\Local\Temp\cd83c6e029a3f4e456aa738538f3f3f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
38KB

MD5
35dc025f460af5eb62707fec0eb31c4c

SHA1
222d07afc892345b5fc59d69a1bd10075eaa5ee7

SHA256
50056a1b26d8ba8bae741fe866c538b275a0a108f46373e2def460baf39f6eb9

SHA512
43639c5794f663c5dda9384ff5cf7c9fb52a7dd6fec235523653b09c92c4d9dbb5ced294e98b7d045ccdd5497605c6bdd8b9861d2e9e55182ac4dac8b919f8c6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
46KB

MD5
dbf68b4e0cdc6f79936925accff9efea

SHA1
2597cc2a8ec71c4020f59b00b732a338b203914b

SHA256
edc72562b0ace1467111b5cd10c426e112f314119b2e968b06962438b7de9a93

SHA512
a0036d307a8823e070a0a7dfea534150522063899d1b008f831cde8c5ce3a406d32743b904de0f7d70e8cbd8c36d153796019e1eb379776006b2dca8038f7e6c

Download Submit
memory/2376-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2376-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download