bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedb

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
Size

53KB
MD5

191fb3d25d21995ab87c82ea4f12d340
SHA1

b516695f67884566d9f83349d7acd795203d2f93
SHA256

bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedb
SHA512

fac3b63d85a23c8659d7bec1cc3428edb67f7646b90b9fe8eb4a85761916200a453db41c58a0ef19d7537f5deb14b20562c9c3d6ebd4bfc41526f23e1edfc7c8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9cmdGwmdGk:V7Zf/FAxTWoJJ7T6mdGwmdGk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a0000000120d6-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2248-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\OutProtect.DVR-MS.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\desktop.ini.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-6.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe

C:\Users\Admin\AppData\Local\Temp\bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe
"C:\Users\Admin\AppData\Local\Temp\bc0462213809f7b4b077034fd1009de04c6447e413043aec00c4dd66041bdedbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
53KB

MD5
5869a59d9129dc2a4e20ee564f7d476c

SHA1
5cef1a0587a1127cf9f7646c79a19677e4099af8

SHA256
fb27b945f25c9131f28e6bf0336e6308c441da8feccb75b6b3e2de17ba7d0ecf

SHA512
85bfa16f7ac3f5a9f28d384a8b09dab36933f7c898dffaf9a228bb802df3c87c9079a102c2ac484a929fd86bcec737a2f7fff3ca4af7ed162baedfe3ed90cb8a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
62KB

MD5
d19c58c60a03f47166397bed5d8762ff

SHA1
09f0ded83829026aabf990619ea556202ced6bcc

SHA256
c83e05faff935c8c8532df587e2ffc4f48aa6be46411e7e6b6e922b43a8f921c

SHA512
fe4664c558a55e21ed2e1c070a90878812ce3759eca0e50e3fd74421ec6238b13970bd2c2a36b093679a457ccd6b8ce72c6611f82c353c69fc956b83b04cc3e0

Download Submit
memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2248-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download