9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
Size

36KB
MD5

8d757ee13a1d04767c9fd5a099e8bd10
SHA1

7d16c99bef7fa0779540bcea55d5b5cc3ccbf874
SHA256

9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33
SHA512

46fa1571b54ce3c477a08f25b803d533147ce186cf7ffe147d6b685382e30986fbba0a22b7aa6616f4af455feeba073ca45fd3e3b3e8d7298c399b8f09046bba
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tielx:CTW7JJ7TTQoQg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3267) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000e000000013b4c-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2280-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\librtp_plugin.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe

C:\Users\Admin\AppData\Local\Temp\9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe
"C:\Users\Admin\AppData\Local\Temp\9361d16391770a71c0329cace67e03e3cd5cd25ccb553e7bcbac72a08b998d33N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
36KB

MD5
02775429b3e4e4a3b79e56d849436bee

SHA1
567fc2425a4e2fed0beb72ce26baaeb362d6f062

SHA256
ff7cf82877e170b6922b6885cbd612b3fef3e59cda170de77432402512c2494d

SHA512
f6cb973b7b8d0bf9a61e199829b1d9a9241461ce5a27ed4618dfcbdc38f6f43dd265aa2a88a7b3dd0ea3920f9eb887d3c9f22608519172a865d6fc7e0aec3f93

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
45KB

MD5
03e42f6822980285b91b8a0021121faa

SHA1
4c3df34ece8ea56e7cf6920f37b60641c07a88b0

SHA256
00728e25fe84187a6fe2872ba6a1368784f7c486c108c2abbc4b874b21dcec8c

SHA512
ffbf64d2c94439f98de37daf2eca609b0bfddf642e816bc49f034ff09a55c9820faccaee76f6329d45d4ab0ba5099b37b660913c8402b3ffbca04d4778570171

Download Submit
memory/2280-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2280-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download