0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdb

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
Size

47KB
MD5

8a1fe52adca55a10c71ea5089c903830
SHA1

434094368bdf036da69294fadbfa2b199f63ebf4
SHA256

0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdb
SHA512

41a971e5e7fb09f2b1e072156c9a8b9da9fd65f5a5964b1e73ebfc33f985a293638100d9915b62b106671b007040cafdd867d191d36f9da9fcc1666053134673
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdc:CTWUnMdyGdyoIOI7

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2772-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a000000012250-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/2772-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-options.jar.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe

C:\Users\Admin\AppData\Local\Temp\0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe
"C:\Users\Admin\AppData\Local\Temp\0388c84b8e4530f74ce376c79eda020246386dd0625ec438a7b885898c147bdbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
47KB

MD5
fe8bbe15a6ef753c73629baabbe5e4b0

SHA1
e57738e70df33611ddcffd861369fe776e2d8934

SHA256
b93bbb08980a5cb91289bb5d09b1352d67899fc57a55300c496564e83f5c786b

SHA512
401fcaf2c54555d49e09224ed494c73be75b3f62d2fc1d1bf0897b1cbe4f498dabf5384c629d3e06432a5efcc4236cad163f5a38629503aa31903718f05d68bb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
85a703b24e8809f058fd31899cadb380

SHA1
64572597b9837b0a27b94188702f773b69292239

SHA256
dcb8bab52d553fbab8a748c7eb18545c126326b8dc9a01f34fc2ac702c68d06a

SHA512
f42635de59cee714bd6a90545818f3c8bd38a2e54a9dbdb66a5797bf594dcd9fb22854d1b8b0a9b53a9136acfb8063cb420fefbe5eadf70c13bbefa7508b1050

Download Submit
memory/2772-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2772-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download