db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
Size

78KB
MD5

27e63555d42eec6cb432100b18793be0
SHA1

ac99102c13d14b33edc4e536b5238e5474362efc
SHA256

db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1
SHA512

f6f29d6476197c56d70a329df70eef8b3c064b981daa0eed8b45dc700f975fe2090056b4dc1f2d67d4ea12b3893fbed4320b5e010057488ee5c199391c3af216
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI982AZJE2AZJ/WBT37CPKD:V7Zf/FAxTWoJJ7TMTW7JJ7TlKX/8KX/l

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (335) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/468-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012233-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/468-26-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DisableSearch.mov.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe

C:\Users\Admin\AppData\Local\Temp\db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe
"C:\Users\Admin\AppData\Local\Temp\db725b08abc4d166ed7439aa6939ee6a110e8bac9c2e91fa674c7ac4a995e4d1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
79KB

MD5
bbc6ff6f1244b2a81b67842c22cccc62

SHA1
51c1fdbe2b741b0ff08eca35c7eec202747225f7

SHA256
a0b0333547c61030bbf793df42b24a445ead6956ac664f63f0cdd66daf3987c3

SHA512
d07fbc0c71d8ecfd8cb3c06937d3ae8a39abaf100417419bcc759663ec47206a6a0a9cc8b5de6c039635f8f8e460476ced63722090eace484f72e4db3eaa4817

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
87KB

MD5
cac616ef6a7a10762f9ea642f80292d4

SHA1
d97b629ec90776d08c0b5898e709c4b418d92855

SHA256
eda8d2e55cced2eee75b49e2aee9cffee341ead757c5d27c42cf769d57eec14a

SHA512
312a4bc0589a328a1f779b882639c74ffb5352b006689e533e784adeb822e8b4f1a63cdb853dda8bf3749ec1738feb122f9c60959e5d5543f17e732d8f180f59

Download Submit
memory/468-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/468-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download