f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
Size

59KB
MD5

bf098a87c3fcf5c1ca73663bdf797fe0
SHA1

9305ef006da8145896b563cbbff665575d4fddbb
SHA256

f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66
SHA512

79615fed4da1f501cbb1256b5bfcc149ee5eaae10dc6acb15fc12f0e2c6f824cf22c6d4b2106c20b6fe89bcda8f1517a25e10d9413c5aeb4d2d5d1e03d351fc8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJl:V7Zf/FAxTWoJJZENTNyoKIKMX

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1788-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000012102-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/1788-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\bin\klist.exe.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\default.jfc.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\VideoLAN\VLC\New_Skins.url.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe

C:\Users\Admin\AppData\Local\Temp\f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe
"C:\Users\Admin\AppData\Local\Temp\f0b78f9d48d28917f633781f4c464c6e3fa671981fd0376d5f1cba3e17b6ce66N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
59KB

MD5
11cc21e74cee5588db0685bcf3dbe269

SHA1
a9ad0b9a18a1229bbdef7176b574eff47300ea3c

SHA256
ed877a3399ba4fc28125482201b7120e2b5a9ff22dff3dd625fe0b53914e1225

SHA512
0e8dd434317f314c24f7666021a39522784295a3e2dc290a4fe1bbd70222e15061bfd414c5e906ffef22eba0159a3727c25b7f290a957f310ad9f8e13901a470

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
22b3604a665207d3244a74902049734e

SHA1
515b2e490b5ef092e36a72fd712a8a9733764446

SHA256
496de56918f0c0dabc49439e7f55789264c0ac628a0f61db1b138549838f516f

SHA512
83421b8b73e44e22ee82d442142f9b61428ff39a6c3e75b331dcbd416e2df087d9bb7ccf71ff67e8c6fbb4e67d045ffe24dc4e998dd6e41b0f7cceff884cbee1

Download Submit
memory/1788-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1788-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download