c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
Size

78KB
MD5

6f8a9a7a12527c9d33aee3a6bee72490
SHA1

c7d6ed27abe65d522df3e818b42983718826cca6
SHA256

c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917
SHA512

944fd7d39f02f358d9b2b83fee7e90bb7186192e456daf9e1f3bfc51e7da1ada9187b3e36514cb32e355d9d8f7c1f319212c92747a681b5cf9854cef3862f319
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxB:fnyiQSoc

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3165) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2308-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\LINEAR_RGB.pf.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe

C:\Users\Admin\AppData\Local\Temp\c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe
"C:\Users\Admin\AppData\Local\Temp\c4df787e0bb840daa530b4484440ef08240029e0155fa8f638947c74494e1917N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
78KB

MD5
d3d2ad8a813d980a2ef8ed39eb11d278

SHA1
e9404400aad5e652993b080c55d9558f42579cce

SHA256
f3794c6117c9a9496b7ac713379981c0a30d31a8ae422eec8c237999e8a8110e

SHA512
d6b4c99d561bfd0be09f01b83a64e9a3383881ded313a5a43bd530a5c438c70074250bf47254ce133f50bfa06e6367217fa1da7b28b0e915243f6cc2a0e2fe3b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
87KB

MD5
a341b0903f39956a5f53e4ca1a097233

SHA1
ec740fa0096ca1b8f0099ca8b7dfc8280cf5feda

SHA256
933b95e0a82d5d41cea2254519c0dca97d786ee1de0df9eeeb746232e6af376c

SHA512
29e38d2abb9ce22a793cf5893dffb69c7ee89e04fc1f339bc5124a6fcebc1b93b483ef11a2bc9fcec7d18c195dbb2e60890933de6a80a416b856468d7e19b64f

Download Submit
memory/2308-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2308-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download