07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
Size

26KB
MD5

3b8f64203c4e7c0c2ef16712fb37be70
SHA1

54f6ab0756a22621dfbd14b3eab543a6a6a090a6
SHA256

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6
SHA512

0a4d92afd89ae5e45cc373f69e33f491eb71283fea42625c1b587d8095bf80e11f5c00308a5ca52e4f50f78988dc9d54e5a805c9f3fd315b8562e3ee1a0ed37b
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9gpw:kBT37CPKKdJJ1EXBwzEXBwdcMcI9gpw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3765) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0008000000012119-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2240-71-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACERECR.DLL.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\main_background.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoBase.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\MoreGames.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\slideShow.css.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Lisbon.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Phoenix.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libadummy_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
"C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
26KB

MD5
658e8fb84ece46ece53d84186db5e2b0

SHA1
a0479bbf469daef17084bfcd0b4deea0110bf800

SHA256
54487f145041b7c2de4aa80c59e5cf2634b064e187395a3ce3bf6c17f244a05d

SHA512
f70175f29beebc5d750d98c896b4791d3da11757c00c42dd0b1a9417be2582daf63f5732440d05bd6f0c2b3e737d9968684e66ccbc8bed2b12c3f8d1497db980

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
35KB

MD5
eb9bc716681d9322d0662da07c2fdf93

SHA1
39c335b8ad00034339a7749c2aecd7b8ee077358

SHA256
4026c75fd9f98c70af9665206dabe0f42e268d4a797ef900b29145369c1d67d8

SHA512
4c92a3b8a79d3ad49003eae94992d08295367c1f49f7f4f1330db7d35d9ab0ee6976c4508f0570354ab9a24af6366c64571762773e6119dcc394f474c9de635c

Download Submit
memory/2240-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2240-71-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download