07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
Size

26KB
MD5

3b8f64203c4e7c0c2ef16712fb37be70
SHA1

54f6ab0756a22621dfbd14b3eab543a6a6a090a6
SHA256

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6
SHA512

0a4d92afd89ae5e45cc373f69e33f491eb71283fea42625c1b587d8095bf80e11f5c00308a5ca52e4f50f78988dc9d54e5a805c9f3fd315b8562e3ee1a0ed37b
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9gpw:kBT37CPKKdJJ1EXBwzEXBwdcMcI9gpw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012116-2.dat	upx
behavioral1/files/0x0002000000010664-6.dat	upx
behavioral1/memory/2524-73-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.properties.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt_0.12.1.v20140903-1023.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
"C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
26KB

MD5
52f8ad344a44c3c17c9a8b0852ec84fb

SHA1
9572e73ef7709de7a09d3cf921d747dda9dfa0d9

SHA256
4dcdc5881fbe152d3a1b9de1537d1649b27c07ac60d5723ec08161ffa88664f7

SHA512
9d3e64080f60d3f4f35eb47bcbf31f1bc63e439b479ef65af1612321ea143e634811516c0239bb3be37bcda0b829f2cea1ff8ffcdda829104ce5a96da1a22bd0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
35KB

MD5
495412cf19a379dc8d26977c5ffa9385

SHA1
884fd4405b90d2b21ded09b11204712a63abcd42

SHA256
38783b7e8841ee0948824075b90830d9a0da5ff0cf9bed8d8f5ab55ce682c8a0

SHA512
adab9e5d03178859f4c91195067ac79a14bf5cf7c91f2b6db27b891471be96f1d0d9110d7dccd978320d362f89ae4df4542a1b34e453b72c02929e9100a67b6e

Download Submit
memory/2524-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2524-73-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download