bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
Size

88KB
MD5

a8cceb3720d588715cc122fd0fc2d9f0
SHA1

22b63d86ebfc9a291c6abae7a5c93a96e8aa198a
SHA256

bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864
SHA512

e5b0ca7cc23ae4f82abe7d5ba76c005e0504f9dd6b1f051d17ff70e06ea4fa3a1907d9b80f4dc8b0d4e233a8100c5297868552d4058220dae4bbb00a26f80fac
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8zxY5a8AmY:enaypQSox5a8K

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2895) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1392-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012033-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/1392-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tarawa.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vienna.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe

C:\Users\Admin\AppData\Local\Temp\bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe
"C:\Users\Admin\AppData\Local\Temp\bb1f5a05e9511268c2f4a4b6ffbaf84547c2125a427aba3b2e40e236104f3864N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
89KB

MD5
373d3cca72808d54380e778c3da6cdb2

SHA1
ecb1abb32587a3ee868a80989cf68606c5bfcdaa

SHA256
7d9c1a60b5a5f51169bf4768e40c954373d65451f6f42465c4dd23e3ffa287e0

SHA512
c1fd6589b1df2f53f33b87aafbcfa6bf7e9625bd4eb57d1f4b98e2e3d1d130b9da671de95abc876a887030048a7bc61caab877402903ccfa34d77c5d4f1f74f7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
98KB

MD5
ebeacb9107ac1d95f0b06b67dfa19f3e

SHA1
78301a8e75fc5de4971dc38df1e6d8f64729a72a

SHA256
56e1a9d064d4c58f5ddf61292ab65f9fc19c966ea7a89e7ca4d64ed3ba4cee54

SHA512
69ec572d0e47b1da4757c2cda557cd3566afd93d3392ef51a29df5c0892dc1ed70ff774e938b6f6ca7461561da6ecae41a065e0a2be70e7c7bee7ec7ec0c97b3

Download Submit
memory/1392-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1392-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download