4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
Size

100KB
MD5

3ca1f3cc1671e8f8cb41153a1ba7f430
SHA1

31e3b47da80e6863179eae88a06d5f125ad3143a
SHA256

4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6
SHA512

72978196b6bb87ef8d0c09b00a33136731b58e2aa4cd5e8a63a668777d3f19c0d6fb072662c88357d6ede299b510bd63fa219fc1f67d958cca2bcf56b90c6b8a
SSDEEP

1536:V7Zf/FAxTWoJJ7TTQoQhaTW7JJ7TTQoQp:fny1oRh5oRp

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fb-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2184-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\security\java.policy.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cancun.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe

C:\Users\Admin\AppData\Local\Temp\4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe
"C:\Users\Admin\AppData\Local\Temp\4dbcf066df1e275e64b1cb3b095432b2060b69920e4a48702fce4af28e4a98d6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
100KB

MD5
9dc3e98216e66198bdf301dddee36392

SHA1
ca0cf00dc75bc021ccfd300fd60643659d5e3af3

SHA256
888967f573cc9082c5e45cb037d295a3a5fd2b458ff36658717b6a9abae79fec

SHA512
99829ed32214501f98997c11b0866c9ff6d5946a3ec4e5d7b80dab738b85fb9c6de5af9602fedf50d6f3c7f642e424cc7e40bb48d06bc6ccecdf33ee19cdcb20

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
e48d0d62fd4295676edc3b67474ce4d5

SHA1
dfe7b26b350da4c2420e567662932c726d16a752

SHA256
a5d6ddac52e962b34983197b8e0b14290f6d8e4c491ffe9f2b1e00a6742c2b3e

SHA512
c683a72f139a9798f8b0805c51a1d1497dc2b749884e82ea14d01a62826a23f31068ee711fc3d45cefb39bd1ce7c17e615cbbe416e2b6c910f1b9c567a568c90

Download Submit
memory/2184-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2184-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download