b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
Size

64KB
MD5

3f7d5945d56bc18006a0b70004b20211
SHA1

05c53368538de7bb639909d039a4a3af291de469
SHA256

b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0
SHA512

d40af6ffedbebad8d800d2690da8cf7192604daeb45b4f32f7eee5f255f4e7c3c473336e50bdf1c4f8f523361d45e8b447afc00488d1595e3957c6b348c92803
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rU:V7Zf/FAxTW/ySSh9j+9jpGnb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001226a-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/3064-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.resources.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\Documentation.url.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\gadget.xml.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_h264_plugin.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe

C:\Users\Admin\AppData\Local\Temp\b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe
"C:\Users\Admin\AppData\Local\Temp\b22a5e99d7c86b96e49b65052e6b1717d18a436c52bd8cf232779fe50ed806b0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
64KB

MD5
99ac962f263777c0d7a7a6f886de8bcb

SHA1
ceaadb6427f35303e1fd4996dc55cefb2c599963

SHA256
d628db580b253d171a9e8060afbdaf1b8d959e4013462f0b1f92843d18106e32

SHA512
ccdf1900d03502a9960e8b6233256bc916fd0062120e64c50896aec81d264522c6428938f8d5696a690fded0e01629ecfef7f627e7663c66cf41c2c1f8559750

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
73KB

MD5
f0a4b49edbbaeeeef0d6a495af1bc9db

SHA1
ba1526d65a5aa2f1f39b47d4bc2ef0cbe757e0bc

SHA256
e0b7efe7d4fb05323e4b977fb762ba3c68c1d3a1045300a64b85d15e25545470

SHA512
882b7ffddf5e743dbcc43f12cead05560de241ea4b62ea4871773ca5f56276ec3a39baa55e01b6d167627deb46f0faa532a5e699b2291f538a1416498508216d

Download Submit
memory/3064-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3064-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download