9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200

Analysis

max time kernel
120s
max time network
21s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
Size

72KB
MD5

291a3abe55b2ec5fc4156056c5b23c90
SHA1

4799c98c08361a66ec6a1e56044c92efdb2a4eeb
SHA256

9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200
SHA512

568fe2872375cd813adadaba111f816278d71f502b7ad09d1d76b35705fc85fca8384cff4101ea385001dd6bfb3714223c051a61891d059a92566e86e4f973ba
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9kBT37CPKKdJJ1EXBwzEb:V7Zf/FAxTWoJJ7TUTW7JJ7TC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3085) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c00000001226b-2.dat	upx
behavioral1/memory/2068-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2068-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-oql.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baghdad.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_ja.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Creston.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe

C:\Users\Admin\AppData\Local\Temp\9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe
"C:\Users\Admin\AppData\Local\Temp\9370ff0127b6764493966d74b0c41b646c54132e67fe3bd64a466dc307453200N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
73KB

MD5
602b96f6798428d28dffbd790ec72b4c

SHA1
20ec6b8f169e6f58d94446403742d57473e246b5

SHA256
d76c7eafc8a2bf0228795f93b531137082edbc3d335037011cf457e8f5036d96

SHA512
0d80730748794c6f92df9af133ae07c3090208254eac42726aa9726d3835edd629ae7e3e3b2fb43c23eac9cd1ccae1275fa539c1b2deadc4e4e31356a98b08a2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
f88a6c27eb82cf7727d131eba27203d6

SHA1
361ea09c8d4a233808ea2e834576ad8260caf8e2

SHA256
fb207b7946a15aeb5723b551a97e4252bb6f8d4e4a6e1d8890897140c042b493

SHA512
1ac3928e82523b33a70d50f646327fecd73cd0feb38132f6ba024031d5b384f7a57985650fb94656b05500a3296d5c1944b4dc7cdc3e8cd6223736187ffb476c

Download Submit
memory/2068-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2068-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download