d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344c

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
Size

120KB
MD5

7b640159e6249d4e1757f7bd8194eb80
SHA1

fd395d3fa8c6625fd6804ff4155614040c1375a4
SHA256

d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344c
SHA512

408d344f94616ed88e13199417bac462b0fa77137b2e5ca150ba3a314221b86e9ec7486238070e49646f0dfa5cf9dc4e7d036e4e15d3cbe5fa52d65d9e7c81c4
SSDEEP

1536:V7Zf/FAxTWtnMdyGdy4AnAJYq8YqnTWUnMdyGdy4AnAJYq8YqugZ:fnyGnpAekgnpAekdgZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2863) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1628-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0005000000011c2f-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/1628-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\ResolveReset.asf.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe

C:\Users\Admin\AppData\Local\Temp\d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe
"C:\Users\Admin\AppData\Local\Temp\d70ccc6c8c0674f361999a46b3558c10e3b197deb5be749bb2040d62b43c344cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
120KB

MD5
34b12af2ec1442dbedfd6e5f5897456b

SHA1
b5cc4cc167aca2c8ae67e4211fed24538d5aed80

SHA256
1a55ac72938346154b244dc7cfb2592c385fed24202c3954e7f89040c96570f4

SHA512
7065049a2598a1dd706cfae9f2f7a6db26363257643c5d029fb8dbee131836c414de62fee12ff3472f168e71b6317c034356ff9a3867dd20dc49d9c521b831f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
129KB

MD5
82f5d1cade2b231b9d85d204321c2091

SHA1
cf8429b5e5b7bcf9d71d0231f7de267959f1e07e

SHA256
d3d1521f7faee5a6659e836b57eb23ea73a02b954a0cd1d41c978d30a680c9c6

SHA512
190d7a6471f02655f6ae969351ae0f72288873f3f11ad72af0df08741988a2da3a1d18504dc12ac5551a043243a10a5c24cbc2ec55c0dea4032224544c13f862

Download Submit
memory/1628-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1628-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download