4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
Size

81KB
MD5

43d0cfadd5cf847e75785f54d1213510
SHA1

a3438aabee222846cc40f2bf3b149a56ab0f35e9
SHA256

4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0
SHA512

c1053682e896478995a3b1abb4b845604848efccf81e20e9238d52c4b70cb84084342e1f285e4793388b6abac24b634ea70a16ad22a71de5657332afb76e7b13
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9e6BT37CPKKdJJ1EXBwzk:V7Zf/FAxTWoJJ7TUgTW7JJ7TUx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2696-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2696-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.png.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_livehttp_plugin.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe

C:\Users\Admin\AppData\Local\Temp\4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe
"C:\Users\Admin\AppData\Local\Temp\4b0d660ce967504a5d8cb2cd922ecc3fb210d8b7952cf24cda5f24824c92caf0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini.tmp

Filesize
81KB

MD5
4a9aa88b573736a928bcce07cb9edfed

SHA1
50653a485e13c45d7aff87a32715ab1b4822107e

SHA256
4960497bd6598bd123077331f4c5b38e9cb94d27e2c867d2491ff131e316a9d2

SHA512
de6122a396dbcde764c941504dd9b2540cbead05a17dbcf8d280852aa49889e1abfc6092653c78b07c199cf96a7978d60cf598a72374224f23dc981283a3009e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
49a94d567821e29459df28a38eb872fa

SHA1
c040d5f8ed3b61eac07e6c677e2912d21e0c64d2

SHA256
4c6a0bf112936d161d1a056fa4e73381a40ec243ff5f71dd06eb91bf37c7d743

SHA512
fc3bd517dcb9821d9c821b9fb02f385ea178bbd244e59e4179f6f40aa40e35ee22d8c4c576160301dfa0fb3fc98101c0b93848befa94e58d30c249e0f127dbb1

Download Submit
memory/2696-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2696-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download