209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9

Analysis

max time kernel
120s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
Size

85KB
MD5

dad7eeb46358a8ddfcdd8b57aa260da0
SHA1

3eab88970f0776697d57921e6c476aeff6bb4168
SHA256

209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9
SHA512

c445f154a0791ff083fc772cbb1c11ada3ea62e41389776b37bd40cc306adc17ceca6d9bb1c3f0def99abe6fb41e2b19a54ece149431ff64642cf99a48c4b3fe
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZiLG6JLG6m:fnyiQSo7ZiLGMLGL

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2894) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012285-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2212-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9YDT.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\bin\ssv.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Andorra.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Rothera.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe

C:\Users\Admin\AppData\Local\Temp\209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe
"C:\Users\Admin\AppData\Local\Temp\209f09af4ffaafbb56af6672e5e2035080f399317cce25ae0a85c7f92cc77bd9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
86KB

MD5
bc8da666566f22a9694b14eeafe36d91

SHA1
185e2952fa76460b66631da573f258b2463fa3fe

SHA256
f4d7a637bc98fb91663c46ddafd96b1053aa695ab2e95a38126e8afd4373f19f

SHA512
ab4c025458b332050192696fa326a53443225e7ec3784ebedd91eac1181e9911d134257eaea2b1eeff030341e8287b547c93338e24317004f91e040ecd621700

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
e3e644c97ae56c55b5e97e11dac98449

SHA1
902731d58e72b2d44ffb43ac5dd52f572f6cb752

SHA256
99a672b632c13c2d011398759217c963ee1945a3e20517616ceff83677586dfc

SHA512
e40144f3e3c3f50db1dfd9c9b3d9166463a2f8034bfa44a0bd2db8653fc4e59c1bf34e947b6f45a8c1129c9cd8a6c862252b0f47a58581c4075d01bdc3fb6489

Download Submit
memory/2212-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2212-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download