a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
Size

103KB
MD5

dd14d1d89d2a55849981d8d8feab39d0
SHA1

870d89b0f2f735494a5f0b671dccdca01cfb247e
SHA256

a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470
SHA512

c6a7984424e5de198d711672aae86b24ed609dfde96025e3c9b68dc2dc416423d9a7ecc4551b1731dd3c588b314a036f89b655d34a0a7e3bd28d4271387b652b
SSDEEP

1536:V7Zf/FAxTWoJJ7T8VseGZvH6Ng6kxyQbs5Otr2DVdZOwo:fny14VszZvH6Ng625/SpdZOt

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3587) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2324-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b0000000122cf-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2324-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\eBook.api.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnuv_plugin.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\1.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Antigua.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Journal\es-ES\JNTFiltr.dll.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe

C:\Users\Admin\AppData\Local\Temp\a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe
"C:\Users\Admin\AppData\Local\Temp\a93bb67070d577472f2bf294b212021062199694844c48aca4a95b8e6cd4e470N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
103KB

MD5
b7cd647994ecd349e025c7a430eaa4bb

SHA1
fa8d30aa75a33d478433c12b50243404a9a23fcd

SHA256
7ebaadde92f306d38bba97c942d10259775abd2802178f5444c33e48d9b9042d

SHA512
6621f0fdafa279b046398ec0c39e6589499c2fbff50e236ab09b4e4fea1d1f40b9f482e27543a8a1819c359e271665119c7d2db9b81d1bc414e4df1ed673520e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
112KB

MD5
ec42e238e817c9382f8673f401704abf

SHA1
4a6446ecae9662c3ed5c69fa39b78649ddebbc6e

SHA256
e33059c6a791200b70234052c616939f92cbcc035619f78eb51a1d99b7b3beb7

SHA512
ef22d8a564d72b04628b75aea620849fe41a69bf3b952fd432a134f7f659d5cc308338aefdf33c489756705b7a76dea1ce29e4c2baebcb188b8227aea03ce325

Download Submit
memory/2324-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2324-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download