a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acb

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
Size

57KB
MD5

51a7d811d8920e8317492182183aeb50
SHA1

234b9ec086f982dff76843b4659aac267488ddba
SHA256

a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acb
SHA512

4533e973a8954bca703ef084933a833cee5913ddbec80dd1826b2f2db555a19307bd356a1677d43ace12708f889b6737e9951ca9b170b61aff4f4daa372de3fa
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8+g9VyjVyB:KQSoC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a0000000120d6-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/2168-71-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\MergeGet.wmf.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\de-DE\chkrzm.exe.mui.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Bougainville.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Midway.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe

C:\Users\Admin\AppData\Local\Temp\a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe
"C:\Users\Admin\AppData\Local\Temp\a205ddd892355b9bdd282b91a37110943c53d2be24d9fcf36ff363e3878e9acbN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
57KB

MD5
1738f714ddd39d1670ae695dd14d81e0

SHA1
68196375dec9c82416056b6d06eb1ba8792c415a

SHA256
c3a187128221fe8c69753ce7775fcd9f042e9cd0135ba0c345fcfaf09d1a9a91

SHA512
66293625742df678db7aac9d99fd9d3bea23399d644a6d38eb1ab455b9adeed6eea4292556979ff48acca7369245099e16343318cd1e89126e0a447773a23090

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
66KB

MD5
ea5817881b52036dcf403a187b6abe21

SHA1
766cfbd233f541a3682d7fd34386e60ae9dc5ca7

SHA256
3a1e7bf3a93f5326647aa0831df71b43804e944610bb505e92f26711f2c77520

SHA512
960e2346ec95374b9dab5e2642bc723d8653a9d0ffe400a25e0b5adea12ffd3f4c6327d7487f08fd49fac548c1e0fa469712f495afea839d79384ee7ef6b15e6

Download Submit
memory/2168-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2168-71-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download