e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
Size

185KB
MD5

1763d9ba13123161b1d70f464a0bf330
SHA1

0bf3931bd51f80db15d2be19801296e84d3d0e3d
SHA256

e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54
SHA512

5311d1bd255c97418310037c4684463d54042e4d9a95dc087608ac6ae0cd327e6bac77d559fa44e4cea0f85576112fb534991a6ba2fe63f66d9eb6b862727ba8
SSDEEP

3072:fny1tEuQ1RCCZHrIZG1SKJqIqrZBSJs1OE5euosTzQhd:KbEuQrCs71qIqrqJsMEHoD

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2856) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1580-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001226b-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/1580-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe

C:\Users\Admin\AppData\Local\Temp\e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
"C:\Users\Admin\AppData\Local\Temp\e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
185KB

MD5
31a1cee4b069f7f160180f001fe54a6d

SHA1
d1c6bd4aa8a1c10f8747fc0d88571b223c0db69a

SHA256
8e43aa7b879fb5d396cac0af34f5173ba43e18bae70a53e36d7084b06033e2de

SHA512
68069a47839008795a0a168963169667acb35021cf564e3273d7021a595ce776c70def1d98ee6c5a738d1d1a0ea19b4d737138c67f6821ae8b9c30a76b2327be

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
194KB

MD5
bf4cb3469e5196bf8bcdeed6f243d4af

SHA1
d1884d1c3793fa66bfd60e12511620f31fd68c53

SHA256
55ca4d1d232a793012bcd401a29fe5cf254386cd34cdaa83910671d4fb57231f

SHA512
9fb05e0e2d7f71a2f4966f3b41ca0fbe82fef2ff8b578006b029d178d1f4016cda619291013bf6041d5c75a00b9aa77afb4154c14f4634f76cbefcbb20224434

Download Submit
memory/1580-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1580-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download