03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
Size

29KB
MD5

2862bfc15b254222104b44d319fba970
SHA1

2ec2c7724531c070740db35183d0b470c093ed79
SHA256

03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79
SHA512

42e71ec87cf35141d13e415e50e8e9f6df60cb045eb3f29d68ffdbb5065ba0b00394097e7442bbafbd0a66e8b40c97feff3ca61e4942d2878a74039d2ed6b02a
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9+rTwWq:kBT37CPKKdJJ1EXBwzEXBwdcMcI9z

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1448-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0005000000010300-2.dat	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/1448-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Malta.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\rt3d.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\PREVIEW.GIF.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.CNT.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\COPYRIGHT.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\vlc.mo.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\PREVIEW.GIF.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\msaddsr.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\settings.css.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\bin\eula.dll.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe

C:\Users\Admin\AppData\Local\Temp\03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe
"C:\Users\Admin\AppData\Local\Temp\03ebad44446cee42e034beeb841f70068e953296e1e1b1ffac946780703bea79N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
29KB

MD5
974969af11fb000e3af55a0134d278d4

SHA1
b5db9dbe23487b7b74fcad97c56b013286998b25

SHA256
c36396961e6711025c31a3e5cdbf037798e414ea8224fc29c292a19718401943

SHA512
d96a08b2c302417d2842b086aad7267768f0d6b290acadd8679bd7b22042832369c095d8233df05149a2dfd99e9abfeecef0874debf118a456eb7276a881b3af

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
38KB

MD5
1981c63fd38d11fa6606da98ff32420e

SHA1
86d84777af31258c4e2069dcefe552a25a6efbea

SHA256
2bfc14b17f6bbd3ac78e774858bed114a889c587f010f0643c09244fd7df688c

SHA512
cd8b1c7bae85c39b99fb370efd0a98a2d0efa3baa236e4a91e0eb63cdebb0dd39067b4c4dd10300ac6d701ca4bdb7869dc7c3e85e575e756ef15c89d2a7aceb3

Download Submit
memory/1448-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1448-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download