fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
Size

47KB
MD5

269f7626dd29bbbbc90bfb17b1f2b5fb
SHA1

ea9fc8edd2c06187768c78e093b545f57f287073
SHA256

fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae
SHA512

c090f71c69b7cd34525a6f0e0729cbcad2b003facb18803b341a2a031adc37ecfe1968b42f61fa50681e32ceb8581e8beaddf7c4270409c4ec4aa7d9f8e5d870
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdi:CTWUnMdyGdyoIOIZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d0000000131aa-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2332-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\settings.css.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.RunTime.Serialization.Resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe

C:\Users\Admin\AppData\Local\Temp\fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe
"C:\Users\Admin\AppData\Local\Temp\fcdcf5a01f07e9b2553f2ff508b9ace532da11a16c667f51e48849059c8d64ae.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
47KB

MD5
3006b4ade840ba9079c04f31797f60ea

SHA1
cc57b7d1d0915001e576707c8e98a099d4082c49

SHA256
fd91ce9920d501f6e3fcd368feb666a9033c1f91a28bfb5a53124089fed7125d

SHA512
0ed21060b8ccb817fd14029644de36556d801b99fb2252a26fcdf6ef7d345b565da12337d5bdecc6f279a4deebfc159bf4ccd1f8cd8141e4d542bd9e88009939

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
3d521ed87a261199d593fc7e29d83a53

SHA1
3b30e4f09021097a0d556d01539c8b06213fa936

SHA256
d5183abd4b0693e8010c704e3f15d1d01c75263c40acaf905f09b72e05490001

SHA512
327a30d127507a4def332dd4cc5ee4e0f253f0e35a0e7b6285274521ac7d54668826116a44bb73de2735fed2fbb168cbe92d605265994e7c4dbcccfb9b85a781

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2332-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download