b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94b

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
Size

73KB
MD5

153e217767cd55c91a1d1963fb0c27f0
SHA1

0e7d455cefdd07dbff52a91e3b53d7de08933794
SHA256

b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94b
SHA512

dbf7df6b1ab2f2c6e4f1b01a6f40f5455b028e74e3e822357710b7e25cd552375db49f3d915c9a33d528e04b840d1defa1b8282ac59e02f6434e22472e368682
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxo:fnyiQSo1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012255-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2200-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Curacao.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ct.sym.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\HST.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-windows.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe

C:\Users\Admin\AppData\Local\Temp\b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe
"C:\Users\Admin\AppData\Local\Temp\b9bde82d4edf86b5cd80d19596fc5fc077fbaa5136aa850d141360e78fc0b94bN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
73KB

MD5
a899a53c1d9b3b77a08b6d585bdb5ef0

SHA1
df4ed55d57ef8d703205bd6ed51c90bf74625616

SHA256
ff0b4689d319dee88ac663503be8100f99782a628604c611ba6e784be3f3a790

SHA512
e41387fc224972887a8ef2f7e793f1a507ef1c65bef23576b6ce267e90a4c22a8cc1d3dd7c87e36d92b60d3770b4cfa34bec5c677f6d8384b765d37ef722a58d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
bd1181466012bedb55dd5bf8f2e730c9

SHA1
4adf2e0b99495c1ba07afbc9ad34b351ed560a13

SHA256
369b4eca558455d3c918d31c4f964d06e05c268abde10c6e7c1173edfd87ba55

SHA512
3a2410738c1a096d9c501dbde0ef0bd4e68aea25e04544d0b0497966d3772e46d9e24e71aebe8e040c53d06bb3e90b2505eac94b34d52c4cb6512d0667f70a6b

Download Submit
memory/2200-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2200-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download