5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
Size

29KB
MD5

72b4018e512b6d02622c8a4ef8de68d0
SHA1

3422ae3e1537274e0c478ab563e84383a544a029
SHA256

5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1
SHA512

e2688745da647b7914c81546ff593419ba7f6b0fffcffd3840f3f952b5452d6c58f90e9213c8aa1afe183eec9eb146a0a215d3e8e534c5433dc65f45981ace03
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9zF:kBT37CPKKdJJ1EXBwzEXBwdcMcI9R

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/584-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000012261-2.dat	upx
behavioral1/files/0x0002000000010480-6.dat	upx
behavioral1/memory/584-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Internet Explorer\iedvtool.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe

C:\Users\Admin\AppData\Local\Temp\5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe
"C:\Users\Admin\AppData\Local\Temp\5945d110833ac60315d0b3581e955cc0102266c46a544ed50687e8e2e86202d1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini.tmp

Filesize
29KB

MD5
1b003d7cef0e33a6f4c8f03cac9822a7

SHA1
75927d4b49d7f7d393626bcede56aa029f85b4da

SHA256
c60fe08c64d0b88cad04c83b12e454cc1bea9c70bba3b6247f7fa663f81d48d6

SHA512
4538c073ece4c578b96be19a7df21d18c3bf76cbdcce267aad5ae28ae906347ce2e7c411b4bcb96b4b8699c991ab8f322086fdd79bfcbc1dee894efec8c4fac0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
38KB

MD5
36503116f72ea5b1ba7d04cbba4b4c17

SHA1
371013859be7077004fe60859a0f5514021282db

SHA256
14971027577f1be091b98f097953bdeb5d64bfad66ec2c5f2e270ad924d7ed75

SHA512
75bb5c9d862704117b0c78702a0f34bff323d660032a8774ed1051fb0b95628f9e06e46ed048c5e2d97a2ea760b69064c1fca43148adcdb06222cff9f5a1cce6

Download Submit
memory/584-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/584-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download