b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
Size

46KB
MD5

b3d64978f86c11c750a5d3e0b5d221b0
SHA1

82137c8ec53eae54242bb2d1c7267caf33ed53bc
SHA256

b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8
SHA512

513a2733c28e375e1ea7d0ab91b178f4848729f23c5efdf6fbac5ea580a182ac04b8e6f3ec21966380629917e609c7697c7e6fc4b93def7e6ae86611d0891fc1
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcuvoE2OiJfoE2OiJa:CTWkySSh9j+9jpGn4ryrj

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3221) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1832-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012253-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/1832-69-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkObj.dll.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Mozilla Firefox\libGLESv2.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterBold.ttf.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\MergeEnable.aifc.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Mozilla Firefox\updater.ini.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Engine.resources.dll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
File created	C:\Program Files\ReadStop.fon.tmp	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe

C:\Users\Admin\AppData\Local\Temp\b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe
"C:\Users\Admin\AppData\Local\Temp\b25f14ceb37c57635aff55236d49d903b51f425530631639daf0debb280644e8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
47KB

MD5
65821b57786b3061ada4cd9ce5886099

SHA1
b837f26080332c27c644542cbba33463942044ea

SHA256
43f512725f16d3f40abbf139acf052b4d1991420ba4d3c16c2d7cf15885f5329

SHA512
e47ce6310135f567c0d74f3d1339f27a31cd09e04b1da7b60056b073be61871453c51e99a61ead1da73ebd24db194374e7ae35fef49683b39e42b51a0c2dd53a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
030dea207b77f1c710b0d4d56e2faf50

SHA1
93823a8b06be96446f0bb8b73b5ac7c896f79227

SHA256
1900edc9e0fff23e9cd65b41584854407c9cb7fc5d90877fab5e1b27bbdcd7f8

SHA512
7dc29b827c38632ef53a220c7bb1c166fdbf2728641b0552268d5f6fb899ecb5989e1e564806941361be6c3e0a1f9a9a3529a3548f7677b90f9dbe451db40cde

Download Submit
memory/1832-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1832-69-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download