f27edb355c53408bff2c47328ba75b259c6d8dcb16e3cd165ab681297c8c2285

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ee5091bc62b7f6db7d3550d01844a10N.exe
Size

53KB
MD5

9ee5091bc62b7f6db7d3550d01844a10
SHA1

a91011af0fb18ea197e5b729cab6da1e3bf40bd1
SHA256

f27edb355c53408bff2c47328ba75b259c6d8dcb16e3cd165ab681297c8c2285
SHA512

c6a336e2babd1c40fce03852930b1138d60df120f8625041eb8f3504cc5b6fbea6635b0332ed6db2b2f4a7b8364015b75321cc09da9454ba010065372b966d7d
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJ1EXBwzEXBwdcMcI9Aq:a7ZyqaFAxTWbJJ7TOq

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0005000000011c2f-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2356-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\desktop.ini.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_PreComp_MATTE_PAL.wmv.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Galapagos.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Lima.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	9ee5091bc62b7f6db7d3550d01844a10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ee5091bc62b7f6db7d3550d01844a10N.exe

C:\Users\Admin\AppData\Local\Temp\9ee5091bc62b7f6db7d3550d01844a10N.exe
"C:\Users\Admin\AppData\Local\Temp\9ee5091bc62b7f6db7d3550d01844a10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
54KB

MD5
23a629a64ea208f07fd54e765091770d

SHA1
c80e72e217058643f61c9301b6b8bb0243eed664

SHA256
277d611b384d98a321932afef814e7383f0c19a124394e87fb0ba2dd97b561e8

SHA512
49abf9fe3d1e6abbaeba83e14536336a26ed693be04c43a9032725ed42bd791afcd351bd08d54c8d93c34a863c87a36f44e22f84f7225b0c557e7790e9e0df33

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
5e8b1719985bec8b8f13a1088ea861cc

SHA1
a2c786c87b9292af23d474d08ddacd33949e092c

SHA256
e5156b056ab3c9deae3e27555528e76b4430de07ef65907128c2fbcee2744665

SHA512
b3c07d5031aadcd5497fd2751b485173fa0abc6578d934498960428150dcc98d94509919cfe128910ad29acd694e993f956fb0132b0681618d56c7617da1c1a0

Download Submit
memory/2356-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2356-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download