e5ad3147913f0c1993e775b380750ab690a3d109d48d727e228f07f473e97af7

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 17:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c87ec6362e566407a60ea3e36c54af0N.exe
Size

62KB
MD5

5c87ec6362e566407a60ea3e36c54af0
SHA1

803f23e32944ef2e8ac616f8a09e1232cce5da02
SHA256

e5ad3147913f0c1993e775b380750ab690a3d109d48d727e228f07f473e97af7
SHA512

117f46c96138af7e6dc6e44c7f287cb5908a8e96c7b89b63829e62681599c3d6505414f25b403783b632ffb53dbf304b87582a0c34e0b9bc807bba8efec47737
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tij:V7Zf/FAxTWoJJ7TTQoQj

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3250) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0009000000012119-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2220-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\RemoveGrant.tiff.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	5c87ec6362e566407a60ea3e36c54af0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c87ec6362e566407a60ea3e36c54af0N.exe

C:\Users\Admin\AppData\Local\Temp\5c87ec6362e566407a60ea3e36c54af0N.exe
"C:\Users\Admin\AppData\Local\Temp\5c87ec6362e566407a60ea3e36c54af0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
62KB

MD5
27151b1fca5443995d3ff8f41f11cc28

SHA1
8b13ff07c95e6d3056d0fccec485973f5bdaaa5d

SHA256
3526f1efc67459b0a92f40477c0f0d20c04fd8976f72227d7dcbe302c467d72b

SHA512
a126ecf9ef4dcf31c64be66d5e5926a80b591154c17eecc7280f970c02d7a35d314e77730cc4988852b699e1e51eae4c4465706a11072d6555b78e5a53ddc1b7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
71KB

MD5
ebff813967ef788692f4350018c5bd92

SHA1
f4b060faae495c588e779672003e7db1811a79db

SHA256
37557fa5354d8cc147f06832e23ff962e0acfbaca2ddf8ec2bd8f32bab41b903

SHA512
0d6dedcd0afd2b4da1a69fc5a35a5990ca06659213b738a7f8bc7a86c99a30f1213e47c28218fc01dbe40765475f61aeeba42eef6ffe2bea8365c11f00ca3386

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download