83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
Size

104KB
MD5

cd8a2dc7f9f74a91fc610fa861e1c7f0
SHA1

b4420067ea0021a1ad7ac2927a7115f49839c31d
SHA256

83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0
SHA512

3690b210210bcd7e23a3de3cf99a4e8718f44e51c3ab00792b208418ad93f36d141d2a91eaa1e2d61485d4b9a1aeecdb1186dfef487c527e24f18d4cdcca8c40
SSDEEP

1536:V7Zf/FAxTWoJJZENTBTYhQmTW7JJZENTBTYhQGfQN/Nr:fny1tEuQFtEuQGfQN/Nr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2520-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2520-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\currency.css.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Xml.Linq.Resources.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\net.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui_5.5.0.165303.jar.tmp	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe

C:\Users\Admin\AppData\Local\Temp\83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe
"C:\Users\Admin\AppData\Local\Temp\83e49d47a65aec441de6d0f6b55af323c08e484ec3bb26c3d37b4d04620635c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
104KB

MD5
03b59118eafeedc58e898f767a036f1d

SHA1
d9d4a4e3549fbacddb9b6771029ab4ec72fe5821

SHA256
2d986760e767124b04131d6277e2cae1986439d054fb3c7f61625e2cd9793976

SHA512
1870ce29f27dada8796942af3fcadaaa908c8aa389c918d59859b4e2db82ef03b7d7a4b74eb0aefbec0a14b96bd9b45d2e8e488b7c0b20e0ead9ae18f5bc42bb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
2eea0ac0acf1d6a521e68de053eb378e

SHA1
829b20c6131b060984ce31854fbc8dcb8a5a7335

SHA256
ae36cd82f1ba40df819e8b64638cedbf82604a99b3bb34ad9c87e229e2f90395

SHA512
0d8c464a313b9ccafcc4444933a2b934880190f741c2c678ba68ff6d8d7ba2cd74618b00948e0d466b2faac57a35e3c412ee50536117cef12490d423d0071994

Download Submit
memory/2520-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2520-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download