d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
Size

65KB
MD5

0e751f1700cbe74aa306cee5aad4e8a3
SHA1

01c0adbc80f475a4e1eb9b2691f39e964a3377f5
SHA256

d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0
SHA512

e3ca87b3ee97f4d82fafb5f9dc7496e5e56cc0b520b694e0c2751935792afcea1343080b67791419a0ce76b33f4e881f3df38d92fc1817b80033b05ac4680cf8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2ry:V7Zf/FAxTW/ySSh9j+9jpGnNBBBR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3744) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/2652-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\CheckpointDeny.mpa.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_settings.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\System\DirectDB.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe

C:\Users\Admin\AppData\Local\Temp\d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
"C:\Users\Admin\AppData\Local\Temp\d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
66KB

MD5
f3cc189ba2b824cfd03d62dc6cf92280

SHA1
a1342f16919769f748d6056ad6a1a5f9a1b3e00c

SHA256
120be31709e18b5b4ba6fcc78c9c118ee4aefa6eaf680ed559f0632667113aea

SHA512
ce452cc90b165d233f73d0a047b48adbae310221dec0e052ea3e74049a8a8ecc4a86778c969c7bb5326b6bc308dc4917eb9d8ed6a44b59ae8fd89c6213c6b5e3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
75KB

MD5
adba6a2962792f210e2b851d09666362

SHA1
c5819306155ab5b07b7035cf8668b11ec6bcd49e

SHA256
f14715b2040adf495609c7d19b091e1e730259df3651bc0b2fd40d2e283a7fb7

SHA512
e7b59f201168199f1a5f93dfec546b0ca47eec17d827af748bf6ca08fa6682dcf0998578a33aeb7449c1ece5cb1248421f0a017a6ddb297a7117b037c253797e

Download Submit
memory/2652-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2652-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download