3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
Size

1.3MB
MD5

df6cb9918ee254ff95f2bfb45cdeaff0
SHA1

ecda7214debb32da1a1454c827802ba13128e9a1
SHA256

3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177
SHA512

b84570fbd3b46d7684104d79cbffc42506853bc37e57231139858bdc0e53017e82503c654522298098dae18624c5f0626ea11a37372816a0bd00ba83cc663c18
SSDEEP

6144:KGnpAbswnDL8X8422OgNEnaOjeN9smOVvIM8k/zB6YaA:Tnq0aaA

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (332) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/2868-62-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\tipresx.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe

C:\Users\Admin\AppData\Local\Temp\3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe
"C:\Users\Admin\AppData\Local\Temp\3497dae24b99d59bead10b20e9ced20d9b4466e36c1b3723c829ce1be6016177N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
1.3MB

MD5
4812e332d988fbe5c907bb36b837848d

SHA1
56a25641eae1cf3aa077bc11260aa7ecaae6f85c

SHA256
33e795e64f24012ae428ae79351caa796acc2c0054109b6b8efa5787ad3f8f3d

SHA512
e4c7f6bb877b570db357271118753fee593a431fd39d2bf2fd0b9e3e134d5338eeb6e397dd9a41fec0f24b7fe13009e4128fa86dc76dad5b04e7428b9e687d5b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
1.3MB

MD5
79fa09bdef55b4245eb9a3e8408fa6e5

SHA1
677464c2c8ea7f7ed92d44fe7e97da2cf21d2dfb

SHA256
f5b941e3cea9fa452770b0f162a0ea6641f030db234666080d31c823c7fd4dc1

SHA512
afa795f032711b7c1fe144f5fc46acedc55281842f2131533bdba12f74faac1cb58788071647673c4ca667c419bcc978fe0d236dff35ef10882afa31fb356149

Download Submit
memory/2868-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2868-62-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download