feff7169c45789ced668b30627e6b22c8a80ec53bc9fe0691f28595c6132f198

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a69aa21373078e6585155af15b8cb850N.exe
Size

27KB
MD5

a69aa21373078e6585155af15b8cb850
SHA1

0783dd15996dd6ef87f7c857e7d0463a6ed1d4d3
SHA256

feff7169c45789ced668b30627e6b22c8a80ec53bc9fe0691f28595c6132f198
SHA512

95c56dfb87d41d534db6f151e515e120fb91827a29edb2934ba454e5bfd9216a545a0167ddf123661308738401d0af80e885eb17cf02dee08618c98829740823
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HS8fI:CTW7JJ7T1S8fI

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/2260-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2260-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Windows Journal\jnwmon.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Windows Journal\Journal.exe.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-11.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Godthab.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	a69aa21373078e6585155af15b8cb850N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	a69aa21373078e6585155af15b8cb850N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a69aa21373078e6585155af15b8cb850N.exe

C:\Users\Admin\AppData\Local\Temp\a69aa21373078e6585155af15b8cb850N.exe
"C:\Users\Admin\AppData\Local\Temp\a69aa21373078e6585155af15b8cb850N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
27KB

MD5
c700de9ff3566631ac606fba96141c73

SHA1
784e01eed86386df8ecb4d75b393c8bf22a4be04

SHA256
c6779783e7ce719af1faf54629b7e8c4c8ce198ea1f07950138e7d14eac6771f

SHA512
119669f720a761db975c058efb665d004824a449dcf6072b683e3fc6d7bb12eca1981f107a150df096b703988196bda0f3bf5bc8b17e79735258009b9d281112

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
36KB

MD5
c1536760b3b1cc97586dbdc072bcc439

SHA1
eea513f051a50f10bff12fb3450746c87621462e

SHA256
c333209fff535040daaac4a10beb66d0f48d3161b7e768691059f4a8c2628dcb

SHA512
7563aeb4f5e3c345302898271cbd45c57a30f9f613fed07f465063ca5a24dbae4c602c2a5523b57cb7249eba3ab1cc846731ed3a73330b658895097d94adec48

Download Submit
memory/2260-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2260-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download