a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
Size

41KB
MD5

a0070aecc1a988cfe8617f4c9d6e4090
SHA1

1457fdc12c9f562a03c3ee2be572e3638fef1da6
SHA256

a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0
SHA512

7175b4df53dd67f214fd16a9cd3add83291d925f193fd54f4afd83ddf7ed7efc4d2df656a09f323458589418a67b52c980264daf77999be9a2d07a4b6eff492a
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcuvoE2OiJfoE2OiJ1:CTWkySSh9j+9jpGn4

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3264) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/964-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librist_plugin.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\TraceRedo.contact.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pitcairn.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe

C:\Users\Admin\AppData\Local\Temp\a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe
"C:\Users\Admin\AppData\Local\Temp\a8f58291a709b834a154ab5c53d072b7845f094c18d3d318653d9ab9b2b5adb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
41KB

MD5
04b5df1e35319e77eae20ede8fb61a82

SHA1
bb803a5c5f8c41aeca9313591a8ec243574db64d

SHA256
5933ea3050cf03601ddb2845d6f07dce44f951ad9e2b1ba8f1e7cf0918f4b7da

SHA512
c5b5a0fddec751f5651203a97ec9c11a3786b51bf2f4f12b32a208b0ec90a9c0ab7b16e4c391e110082a9dccaf681f83a4361b761aad3c17f97ed9163855383b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
50KB

MD5
8bb94c499d3c976d1ead0e02ca39b116

SHA1
d0440cedbb3192bff05b95f4c14db0dfae908c08

SHA256
d3bd902e4f60779f1c7b34262088f1f217ab9fa4cbd79b79aad5b8eefdb81f75

SHA512
13f2f1dc7d38514023d3f298a395ba99b64c019f7769325bc5fa163dff944869882060ba745992a61f619a65b7db639450359a64f71fdea49ffa702751dabc38

Download Submit
memory/964-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/964-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download