833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdc

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
Size

46KB
MD5

0c8f3423de6f321a7bb483d367ab4780
SHA1

6d034f9c5ff37844426952ec9d532ffc481315b6
SHA256

833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdc
SHA512

6e9f3112a3475f374bc1ffc1661d7410f72f74bf0ffddf584f674109aa2079f6916bf1cef008fe689f5b2477ced7c3155edb651f0e3e0838225ed7a31d37d587
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Ajs:V7Zf/FAxTWoJJ7T2js

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3366) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c000000012281-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2200-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\classlist.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsdt.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.server_8.1.14.v20131031.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Iqaluit.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\VideoLAN\VLC\Documentation.url.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Nome.tmp	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe

C:\Users\Admin\AppData\Local\Temp\833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe
"C:\Users\Admin\AppData\Local\Temp\833cce972ad6f9d482a0efa231cc6b0131bd1bdb3e2a0510ab6e87e7b5e95fdcN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
47KB

MD5
ea8d65cc8ea28dd2a2831417b675378b

SHA1
7f96f78258e0bcbdbfe343b25601dfa16804f6b7

SHA256
f245b5967bf61efd2e0e5d4259809893ff064bef66d167abf62d8e14984504f1

SHA512
1e51f4d060618adaaff8749ad4f87378960848517be111f34515d5144afcbad32e235779791acfd2b4e6f86b67e3ec8204717d63ede42a83deabe0f60bd82d44

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
26f27f54e2ec06952b94ee6e8d5aba73

SHA1
c108c911272556ce7a9f83f938f746f85558e7c1

SHA256
581d5c94d4d41c113a6906c74d0c63e11565e299c0349ddff2bbeb70fef49486

SHA512
b9e73d589f2b4e94b342a611ced0d3a7d806ef64fa41c8e0ed2ef183663c3ed9da90e77ca6077cfa0ca89c427088a43a80e4a399eccee006c605931d6b3b710c

Download Submit
memory/2200-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2200-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download