370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
Size

150KB
MD5

be0c84ef45d9627e9118ee786291490e
SHA1

be0a4f064e22eb9819e17b677e79984b0282d2fa
SHA256

370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3
SHA512

20379e1098d014aabf2f94238a078040f8e5c604d2dbc99bf052107d460a0922dbbb05f44bd5929b18b00646d336e03e60e6cebde2dc3b999ca5a8b67c0d963b
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5eYAWUTWn1++PJHJXA/OsIZfzc3/k:fnyiQSox56QSox5j

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3458) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1400-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/1400-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawaud_plugin.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\SearchUnpublish.i64.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libconsole_logger_plugin.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ChkrRes.dll.mui.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe

C:\Users\Admin\AppData\Local\Temp\370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe
"C:\Users\Admin\AppData\Local\Temp\370dc5ccd9672f7721d27fed427caea71b479d73df1b78b8bf2ac0031d112ce3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
150KB

MD5
9cf87e67dddd2ee75b1b5decbe999216

SHA1
9b350d44133bb5be3bbb7b9dba52bcbbf980944b

SHA256
ac370536978cab204e7f0ff1263a1d5cecaa52b622788ba4312f5f13939d0865

SHA512
30650e59869351a507c20cc907dd4c8f23fd641db624c149ac05cfa6992445276171bd977e51533e29aa16eb1cf83cf62f1dfccd7edc47dc00a3bf19bc69b9a2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
159KB

MD5
d512b1a195fc835a7ee53694bbf5fa82

SHA1
560bc5667f5fc0a2aa29c37007b9e2348971aa89

SHA256
addd4bf3648234aee8fa56165d8f19e809bc11bebe2f08fec96013471049d463

SHA512
ccb6d3b13b4bca5cec0ef576e82477083c9ea9c5fc38843d72338e855ddf3fde5cd41a46e630e62ce1fc8d35d112c20599ad88ef65f543742c04220ea9a6b4b9

Download Submit
memory/1400-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1400-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download