9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
Size

95KB
MD5

52cf336fcad035691b5c836cf9919770
SHA1

554206730df8cdc12197d0129c3431f904db4cf7
SHA256

9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53
SHA512

668688d13c7e48a7dec4f2100f34f94bd5e1db9e2d51085f96f3d4f4f01f3091210d859f8b878f737649f125ebe93dfd9a1850aad5a8f3a4d9b447407749e318
SSDEEP

1536:V7Zf/FAxTWoJJZENTBTYhQ9TW7JJZENTBTYhQ+:fny1tEuQmtEuQ+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3084) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001202a-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2348-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Phoenix.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar.tmp	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe

C:\Users\Admin\AppData\Local\Temp\9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe
"C:\Users\Admin\AppData\Local\Temp\9862e6f2cb25fee720d9d67c22e2d880636a5d51b163a3df57100785479d8e53N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
95KB

MD5
6a19b92d1a4f6aafee6655ffd9a80752

SHA1
9916751ca281c9769e74e427fe2ca1ed7cfc8fcf

SHA256
bf3257a57613cb825d160fef931123e2776eb34fd57cc5943317d64b417aa582

SHA512
d674dded4e18c85f6185de8685ef6a1f50571bdc33df0db89cbb1ed93fd8c987242f7ec1fde84f27693f0b247891746cf952d8077bb6ba8c7a92ee3ea609f856

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
cb2e587de6ffd2a8e9b943de4eddea79

SHA1
79b987b154e4291ffc3ff54c5b10eeab9d67220a

SHA256
0748580f1ac49ed077af594c29d5a00fd5ce4ffc2254dcbe8c241011f0ce8445

SHA512
6cc466dfcef0cb368f218d377f6f5b8afa313b4feadec78e559968ed35494a5d6a42214baf151a99f9845631da01ccdd0158cd97d80f076a7c486cd86b8c8b8c

Download Submit
memory/2348-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2348-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download