45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59

Analysis

max time kernel
151s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
Size

67KB
MD5

8d0d531abbab040746551883ca57c6b0
SHA1

d109bb6c5e3a4a1f735bcc96316e586243ab0822
SHA256

45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59
SHA512

1a6204651537222a5a657ab3a6fa3502dc35d8b5e72c69898493c105c9763fbc11fad25e571cc48ee6c77e72cb1c104b757cf542b6fe0b2091f7a2add49f5a6d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiDoe+oer:V7Zf/FAxTWoJJ7TTQoQtEr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (600) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2256-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012250-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/2256-22-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_shmem.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwLatin.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe

C:\Users\Admin\AppData\Local\Temp\45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe
"C:\Users\Admin\AppData\Local\Temp\45a1ecfc37b71688fbabb181f75832d009e4dc4541e267ea85eec5831a635d59N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
67KB

MD5
27b2b7bc1996124350baa1a48557b662

SHA1
8fa0d8b2b6351aa1f3610ca1a9aae16ecde32944

SHA256
cbc826bacb93d26e976127644599ebc5a9f2ee15d57ba4917fcc7fd120db403d

SHA512
d10eb99158563c8dadd1c2452af8a2205d2ddfc3038ac9be6371917d9c38bffaeadbbdfcfad519bc93fd237f732af909c2a26534b7035e560b9d99735d561809

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
76KB

MD5
ccfcf24945ab4d8f7ed33a3c0707bb89

SHA1
55dba94143deac5eda160e10cfa1dde28fab9a63

SHA256
f0b418f7f8d834d3538a1f319aa04c83e6c153348effbca08b11dd262153919c

SHA512
f90c338947318c2e468e77aa393f01db85a9733fd81fc464171687cd0c3a65301e84e63bc2821fd1d4bc4fe0d54c69e268d946ac784ba00887e1ecda5a7f51f0

Download Submit
memory/2256-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2256-22-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download