82ea3f69ef8df4bba45a9f7264dee6d651e1432547c246c22dd9dcd487c51bf1

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aa4463a321cde7dea17f9efdf9dad50N.exe
Size

77KB
MD5

7aa4463a321cde7dea17f9efdf9dad50
SHA1

e035ee707c4b6dff6b90ffe890a3979c3ee72c6d
SHA256

82ea3f69ef8df4bba45a9f7264dee6d651e1432547c246c22dd9dcd487c51bf1
SHA512

53fc265fff7397f31ee4ec4ebd3c544e3d413e0620ed1ffe15881c3d91a2c114ed746a3d49cba05d01d92da1b3206f478c32a01252198c1a422be9663950a4f8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQW:V7Zf/FAxTWoJJZENTNyavf73tQqKBBBF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3207) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fe-2.dat	upx
behavioral1/files/0x000400000001043d-6.dat	upx
behavioral1/memory/1924-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Catamarca.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\ConvertSync.hta.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\index.html.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre7\bin\jli.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-math-l1-1-0.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aa4463a321cde7dea17f9efdf9dad50N.exe

C:\Users\Admin\AppData\Local\Temp\7aa4463a321cde7dea17f9efdf9dad50N.exe
"C:\Users\Admin\AppData\Local\Temp\7aa4463a321cde7dea17f9efdf9dad50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini.tmp

Filesize
77KB

MD5
1c0a7892a02f05d37c0b04839db764b0

SHA1
445133e6212422603fdb2058c837c00de2fcb051

SHA256
0c2b682f44a753f94b736680e012de78a6cc913e236243f93052973afcb934c3

SHA512
521483bc36249fee2733d37e012b3f55bce6f1d7564497823c55981e4da5344f69352e6cfa94e3ccd31decab40748ea9ff161f2ad62119b1a7d90937ccac5643

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
233870339aeca90d64b053390e245771

SHA1
bf2f93e436163710499613f0da9c27ba6eb59478

SHA256
854686e641e83520f0d206b65a3c54f380e7eba94fce07adbb5ac30ab13bab03

SHA512
ec11e1b76de34c1ddd8b7e6f9b0c837366b9e7c199a3bdf87dead50af1f674597a55aec20fbb961782ab5f73611011a546c876423280a472ef81c38fab8b7ed0

Download Submit
memory/1924-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1924-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download