6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfb

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
Size

75KB
MD5

641526824f313b575d1950a899823530
SHA1

d690e67faafba3255cb501f8e584e8089a2db580
SHA256

6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfb
SHA512

fe8a5831d241335df8b914e235a7c85d17089e60a802bfc1efc6087ce19508d569b4bc02b5bc0116914a456238515a28aff57605ed260ea9689e0c4872d490db
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9iBT37CPKKdJJ1EXBwzE/:V7Zf/FAxTWoJJ7TiTW7JJ7Te

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (421) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012260-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/2248-26-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe

C:\Users\Admin\AppData\Local\Temp\6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe
"C:\Users\Admin\AppData\Local\Temp\6f9e15becf83635c975f37ded656cb971ad8dfc169a5df71ebbff2ca3e621cfbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
76KB

MD5
b238cfd77221cded29ab064fed6f2cf8

SHA1
1fe7d0a2635707a8c65d21f4fc1cf35f128371a6

SHA256
b097c0f90fb3706a277fec60455fa4ea69e8b51e0a2a150822586081ff1bacca

SHA512
4a949d718e694b60b7cc070e709783d7c70a1ca13c0bca60beb4d83dc480d8b037233d3e8c4200e25f1bc7f20e582c8b96e1f364f34821317628317959c93ead

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
722dd12cafb042265e369c890172da9b

SHA1
6f454e0fd192675d595c0312e233c2e642231d46

SHA256
a3490f4e6a8b486bac182bc66778e0133faeaf283354ea02dfdddacd5b466fef

SHA512
b0f22c647196e4aa4c0ee4bcbf3ec9622047fe47603a1ca1f5a6e00f00a27c6a05d7e55813b0e4f5a1fad01f749944a71c43b2c0bce58aa2d81a5bd5fa61ade2

Download Submit
memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2248-26-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download