ad8088ef225e71bab5064e34d8c4fe0425393f2d3fd8406ca762f19893bd415e

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e3c2326949fa576af55c54a561dfa650N.exe
Size

73KB
MD5

e3c2326949fa576af55c54a561dfa650
SHA1

7e3f1f117d102d65621ae22fe4b391c3e4a93348
SHA256

ad8088ef225e71bab5064e34d8c4fe0425393f2d3fd8406ca762f19893bd415e
SHA512

930c5546aa4ae955a074c8a8870f5bd498796db9a74a057396ce617fb340e5716ff740ab38531dd71740267faa219e6cf21e00a7491b71f5f5c0631567e82eee
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rl:V7Zf/FAxTWtnMdyGdy4AnAP4FRz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012118-2.dat	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/2120-72-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libntservice_plugin.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	e3c2326949fa576af55c54a561dfa650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3c2326949fa576af55c54a561dfa650N.exe

C:\Users\Admin\AppData\Local\Temp\e3c2326949fa576af55c54a561dfa650N.exe
"C:\Users\Admin\AppData\Local\Temp\e3c2326949fa576af55c54a561dfa650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
74KB

MD5
509017a27cb830ee6ed5ed7292250357

SHA1
13aa76dc6cd37a9e28f9dc66d98cc6fe5c172160

SHA256
1d3fa629010f3ead3d01010c0fb7b221c0c7368e9533a975b37e2dc73ab92542

SHA512
7d2e2a73230ae286f27a5964cc6f8225857b64f0c0dd3acb8f108b1f6d5fae51ca52d2885da84cb2666327ebe8c11e006188eb7cff13d10effb239f395d5a460

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
83KB

MD5
9bf0cdbb958eb4aeb261314185f64cf3

SHA1
91aefe2af8de06e853b2e472b780ab818498501a

SHA256
3bd7abe70a722dce7108e36926caf8278f0f1a96c54bbea45fb548e1eaaa58e9

SHA512
2645361a98b843635421ccc017ddb49a458ea6a01cff91c0db10c1936aed7b21d43bd3abc70e52055828e1091b599ef5cb468b0b264267feafcf0022dc2880ab

Download Submit
memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2120-72-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download