a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
Size

53KB
MD5

628e8b85d5674912273c3e6f6748c221
SHA1

31d5e4e2cb56aac9f08c89b34bcc31ec8dec62e6
SHA256

a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687
SHA512

30fc605579eaa6de9c4cb9c15645d6304fae82d5c0b88492e0c8ce1c8b1144de08bfc06c1b0a4adeac78074a6a6d629510fd520fee0d801ef57420b6dd1d3f85
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9wStuStY:V7Zf/FAxTWoJJ7T2StuStY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3775) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/1860-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/1860-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\Sidebar.exe.mui.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\PublishUse.pcx.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.log.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\settings.css.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nipigon.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe

C:\Users\Admin\AppData\Local\Temp\a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe
"C:\Users\Admin\AppData\Local\Temp\a5e294381be15080017bf3fa16def69db125022761975e9aa53f31fd2a2c9687.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
53KB

MD5
8247c9af7aa09b76a040663e1fab7d75

SHA1
f34baae73ed73343d587963aeb6f09495e0c9f7d

SHA256
b2f1ef1d566cf9baf6da2a7dd3d554ac050845b8f02ef87236300660c4debab1

SHA512
9f51e12908c881ecd966f5bbd013c4ffdc23d8ff966e08852c7d39bb492bb1749cbdb5d2b311d554482c25156a42e6e043868657eb8fe6976c8e3d5284bd9104

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
bbd560a3671ce3012729317694c13135

SHA1
af6bc2446c878dce3a050875a4f1d255bf24c4e8

SHA256
9b98204c1ae547f1db323fd95fbd4cbcb7f7e515d783c4af3fe05a371e7f9868

SHA512
411395e9275380612e7807b2fe02eacc4a2e1d044a748776fa6075710f3ee21829bae57cc790d7e21c6cbc6bbb20b5dd6bd113e1e246fa2352e3b1916cbc3178

Download Submit
memory/1860-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1860-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download