217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87fee

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
Size

72KB
MD5

1abf1cc59ce2e7319ccf8c2988275d60
SHA1

f6fda5641f252ed1660502b9a53d9a801abb8649
SHA256

217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87fee
SHA512

af1db3594f0d6e2757336dfb4495a69c3e2d272afab2665bf896df2053cb2d56b48ec019d70656bbe7cfc6489b1fdb73bbb2ad6c283a152b86ade69003318578
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2r5:V7Zf/FAxTWtnMdyGdy4AnAJYq8Yqb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3096) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1172-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/1172-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
File created	C:\Program Files\ConvertReceive.pdf.tmp	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe

C:\Users\Admin\AppData\Local\Temp\217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe
"C:\Users\Admin\AppData\Local\Temp\217fe9c2375a771c937ba86b64250656f6d4f7ce29678134b4302564d5b87feeN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
72KB

MD5
ae333be3ad3d6719569a74c7181f0d6f

SHA1
1d38df5bb4da869d2f706f12a0af659a5e8d942d

SHA256
168e8c0b429ed779201a7410b265aa9b8112ab431a99102ebceb19856c8d8b83

SHA512
e5e9b7c45b80c08316f4fdfb01d32ee18e6433d6b4f0449ab26bf5a793ec9a995a1ace6cc68d0e5f1f1d1e75aba45879e22c557e11825822227cd19ca4e65350

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
8fe093cfec0934051d4c41aa519fd550

SHA1
3c9ca482be08b8df0f153e772c13c49abf0be200

SHA256
bd4391d70489f3cb869dea118db2bb644826e24db83fb844565f0b7ffabbfb8b

SHA512
47e81c6ac9067cf77b5d99587f8020d5acd8f4cae5d3de7a992e6e7b7ec3344f00327f90dab8022fc235d3808be350450d8ea60b154892106cc26fc9681535e2

Download Submit
memory/1172-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1172-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download