15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1f

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
Size

59KB
MD5

2370ee7bdbe16a63afeb506101828840
SHA1

43da8736810d364ac1596c3c6920b2d5b797f01d
SHA256

15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1f
SHA512

9e7793a0c29bd68362502c4af0ea10e4ef8ff9e0a6db0e052029503cca7e669272f220fa185f61218ef4f8058e96a6e0a2ceb0dfae1d9e5ed72e9ed31377c3f9
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJTU3U2lRtJfO5mdGwmdGoqAJUqAJy:V7Zf/FAxTWoJJTU3UytJfO5mdGwmdGy

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012263-2.dat	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/2376-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yakutat.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\ShvlRes.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dummy.luac.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe

C:\Users\Admin\AppData\Local\Temp\15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe
"C:\Users\Admin\AppData\Local\Temp\15663be555ee19affc135c03c3ecd82cc26e8ca59461dbb5d7a03731abf2fe1fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
59KB

MD5
c48ed46f4d7c75aa6a6325edb68190cc

SHA1
91737e7e7962b641fa7a46e859c3d185aba02c7a

SHA256
f07df3467ebb23db59e39e3bcbad7bb240722134dbdeb6c3c72b31d27930f4c6

SHA512
9c34229e901e0657909cec1f4134aae80d3c037c55afaeaa18240bcef0bba50c295e8e4ff71874bfc7fc3e42ce80070315d7c082d17a95734dbdb89cf11c8f61

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
ad6b00218f8e518c515c6f17c3ef90c3

SHA1
3f09248d5c6880bfba180fbc027d52fce75e7154

SHA256
31962feb43467231187d4e66abdbe725034774173d789b16a48282b0cf396f71

SHA512
cda3feb43d40669957a5b88b6b3f5755393d5f5eb2f1e9b97fbec4ade0c4a7ddfac8e6d857ac4de192a05832d1593310cdbfa0ca3d7c3a56b2a4a7ff3de59620

Download Submit
memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2376-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download