60ac209b588abcf68eeb2456c10744aba3d129e092b36edeb93658dd29cc8db9

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d031564c191c853b1b0737e0f2e2920N.exe
Size

84KB
MD5

2d031564c191c853b1b0737e0f2e2920
SHA1

0e0540bf61545354a7134499f06ccdfa3f8f1429
SHA256

60ac209b588abcf68eeb2456c10744aba3d129e092b36edeb93658dd29cc8db9
SHA512

840a7ef66967355ef600fc4034c08651f8a3ac716f140494c92cf1a1aa62a079db6904a8c467dc8f9614f3de9d03bf3d38954dc2274271719fdebabe0106f07e
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZTgZtZhZtZI:enaypQSo7ZsrW

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2960) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2560-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000012102-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/2560-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Mozilla Firefox\postSigningData.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\README.html.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d031564c191c853b1b0737e0f2e2920N.exe

C:\Users\Admin\AppData\Local\Temp\2d031564c191c853b1b0737e0f2e2920N.exe
"C:\Users\Admin\AppData\Local\Temp\2d031564c191c853b1b0737e0f2e2920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
84KB

MD5
195b1f0c48ce2abd6c57dd690a46bd0b

SHA1
b6c4e35418d15946ebbf2873a68002c05520630d

SHA256
3ce9ae329713fadd32216203e806a4a8fd029507b1ffef2ebe4bd674eae86b24

SHA512
0ea198625fa328b55e8d109e51a5efc8007b3bd25bc5f90e1ad8c51964e310770c1f9e472e1af5875f02c3333e73a9a5598176d54d8f4f9bd17e0b09fae0f036

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
dabd37e149f487300ab0e0266978e477

SHA1
0dbc0c6590e2e7753ef9a60ceaefd345fa389392

SHA256
ea37dd43059469e6c7947bf1a4ec62ba1c9d2b0627bd3f8bb16d08514dce6b2e

SHA512
b3e7f752d4e6db6446170f075a335d3ccd7ee41babfc43c7442eb2225c31598e861d88cfdcd7eb0b93f633e99a659699f2d527c43f845ca767c77aac5ada35ac

Download Submit
memory/2560-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2560-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download