38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
Size

85KB
MD5

d773e792fb3804582f93283d694bb6a4
SHA1

944719faa280cfa2fcec7fc30e0f426d613bd077
SHA256

38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603
SHA512

ad1963b2536df6b57eab6a68208dd3fc3cea6d965531b01936401b5d82c87c5b6353b8ddf0647cae9a38624289502140456c73bc15381cd40ef2517fa3ff8955
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8+g9VyjVyDeUeR:fnyiQSoCeUeR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2396-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120fb-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2396-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmpgv_plugin.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_shout_plugin.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\tipresx.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_hevc_plugin.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.properties.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe

C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
"C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
86KB

MD5
71ba6182a2f19377b83a68f24e43c49e

SHA1
f9d4219f530d00e7591458cbe7a4520b64d95c69

SHA256
1cf622767d2a9487bbf70ed0d13cf38928f5c5d2ca3633d5b149bf4af696ad80

SHA512
1ce169afa431882062ef7748f20b9b2e6ee5c7af8d9148143ed890cef4dd5c0502d93d1c02023e5ab4b3435eda277e2f54c567bfd87cf4e280c925f1ee47818c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
a4edfdbad2955b69cd3eb622236d9981

SHA1
e2de108fcb218a44f18e260e8da16a86d142ed75

SHA256
202c02a04094a8dba410c4fa1b6f6527a0646584722b47a0ba18701f9cb81d06

SHA512
17ca67035ed010d530cce43a52713d2d1fc4d2b11550fdf5bfd3dc867bfc51a83f545e0566e7f17fa6aa4669add1b0b652b40bf47d4deef47195522b7bf5b4fa

Download Submit
memory/2396-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2396-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download