a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
Size

60KB
MD5

305a3a3058eb3197bbf82a64b8431ae0
SHA1

2b1bc4b2911ee92ff6eb73a684d1bfcf157edef7
SHA256

a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0c
SHA512

3917240645a2acd7ef93f63c40cc0cf14a106092d2953278a3c758474c362da4eb071a6161f0d5587c5253a798b37145a6bd49d9877c0eaa8d494e25bc8f8a4e
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIR:CTWn1++PJHJXA/OsIZfzc3/Q8IZaif

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3116) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1648-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012119-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/1648-72-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-windows.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\cursors.properties.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_ja.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_ButtonGraphic.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Norfolk.tmp	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe

C:\Users\Admin\AppData\Local\Temp\a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe
"C:\Users\Admin\AppData\Local\Temp\a77f2948ff4f8da394a849cc93609bbb954ab42294b2c5612ec66ae512136d0cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
60KB

MD5
10d71986302021528977721d082cff9c

SHA1
e8fe9464c876c75cf159e27b16567fcd10e0879b

SHA256
dd881c8d1e0e584c063a7d2f6a66adb72d8599a98e294e8b5eb2394ca77f38d6

SHA512
a15639473d852432a67df8f8a4b243231cef198260c803b74aa29c2e2dc9ffe479fadbc99ffcb58e2fbc3b6e62763892c180fea6533963d21cc147e357f5c7c0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
69KB

MD5
433ae09d216e271f38d646d77926fea4

SHA1
4b012c08185598916d3bcd5db06ab37c1251a5df

SHA256
5a511640c441735bc56e383489189cf79f56c1efd694195a41df3ea4a5bce2ac

SHA512
6e7558cf9a68fe0b0bd0a3b3948565c49d49874b97a92fb1adea48490cd33154e0c2cb7a60b2c384c8f76d98b05435cbd85a4ec309bc616d6a271765516da5c0

Download Submit
memory/1648-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1648-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download