08a347d0939d8e6e74952db9d58be5342e2762e290069cfc2c0197c9bffa433d

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4a3975c6656c4d78ecbfed33952bc60N.exe
Size

53KB
MD5

f4a3975c6656c4d78ecbfed33952bc60
SHA1

4812c8d8c6c9cc5b487991054462f9d796652ca0
SHA256

08a347d0939d8e6e74952db9d58be5342e2762e290069cfc2c0197c9bffa433d
SHA512

61fe880c212582138b7f5dcf33ba9a47283f32861f5bcd8c1c7633d5f0670ce4d6c5839fcbf0b4fee0c8afcbd73a8bdc5c2d117f6b922af8796061137cf2cefc
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJBZBZyF/MF/orMalYNR2F/MF/fgZga:a7ZyqaFAxTWbJJB7i2JalYNRs23gZga

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3252) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2000-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a0000000120d5-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2000-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sunec.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Manaus.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wallis.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	f4a3975c6656c4d78ecbfed33952bc60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f4a3975c6656c4d78ecbfed33952bc60N.exe

C:\Users\Admin\AppData\Local\Temp\f4a3975c6656c4d78ecbfed33952bc60N.exe
"C:\Users\Admin\AppData\Local\Temp\f4a3975c6656c4d78ecbfed33952bc60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
53KB

MD5
865141b09d7cc4bcc202a475bee3a948

SHA1
601fd4264efe69856fb73bdddbe48fce5ec2bfc7

SHA256
4b858c5ecd987c9d123cb8d9b083883e5effdbe0af7aae19a881b5e2bf12cac5

SHA512
108b28468ca3a5ef6eb98a871cfe503442dc44fa0dd1a7a60675646048f9802d9f2f04c89086c51abe7b19d1b113593cc6145ac4ef7723aa3bcb22f61dec2cca

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
6d902be2e466781dde6bfbae52508ba7

SHA1
d53148e88921d725098ed8afa28d7f1da419216c

SHA256
f0152edf5fec834dfd33d5e8c0547c06ebbe99d9301152b4727076161ed44023

SHA512
8aef222cad4d28f42768d1933c586053184481e5fc7f6d5fc05b7c3515e5e9092af7e4aa9489cb548e928627b93ff8b87203681261bc9bdf2435afa4f132bc32

Download Submit
memory/2000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2000-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download