994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56a

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
Size

141KB
MD5

8dcc1a2bff072e0dee6907be8ce50c70
SHA1

1b8f876191c1186efffa884ec423d36f2b6a97fa
SHA256

994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56a
SHA512

03cc87b5b26161265c85e92a3a94b95c46ba9fdd4ec755939a025969852c415cb17931ca743ce2b98f5269c3d366c00457079b5d43772650f97cb46a588d1710
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZuTWn1++PJHJXA/OsIZfzc3/Q8IZY:fnyiQSo7ZuQSo7ZY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2842) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1272-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000012102-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/1272-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lord_Howe.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\PopConvertTo.gif.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe

C:\Users\Admin\AppData\Local\Temp\994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe
"C:\Users\Admin\AppData\Local\Temp\994bfecf7eb44b0832a3a41be7c8f6cd56db5c658fd4d5310c29030e5869b56aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
141KB

MD5
588862510baba52d24913195254a6e65

SHA1
8e64cf2999e7d8ccad0648f5cd828a4b56be8bf6

SHA256
97da3574aebccc91211253f5115c46dd967b4ad8a4ae8bfe3cb7f2d77857a019

SHA512
9171cae186252c49de2ab3d253f8f11bc878c70209923e3238d7a8db5715d5291544499f0f8502fa67b82b882a79e1dcf0470946bd938849ee605756ac4354ac

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
150KB

MD5
a8df00d76d258108462508af717f68d8

SHA1
d0959145cf9c4f157acb22935f59344c9713f36b

SHA256
2076a58f845bcc40fda2c7fbb9273cba3d9e04c03291d5ce6fcf9ec70eb0e3a5

SHA512
bb74f6d6da969972f6328e2c76efefad5aac1fb9af83dcdead887e72f8d0d5999cf312cb5b594b0bba483b3e90e8daa3e8ef956d981c075a3ee0e21ca474ed89

Download Submit
memory/1272-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1272-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download