2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741ee

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
Size

85KB
MD5

15bd34730354d3fef8946bc654151320
SHA1

07f128e4af8d47a576adc996732ad2fc79e1a986
SHA256

2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741ee
SHA512

a8af865306dd9688c301735880bab0e051575ed2541717a75c9a54e819e5e2c778e53ef75a3433446eca218ccefc80ec8808fc9e33c20a548e82b8bdd9a08103
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTwhx58hx5S:fnyiQSo7Z6xcxM

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2911) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0007000000012119-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2848-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\DVD Maker\ja-JP\OmdProject.dll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-coredump.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\DVD Maker\ja-JP\DVDMaker.exe.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Enderbury.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe

C:\Users\Admin\AppData\Local\Temp\2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe
"C:\Users\Admin\AppData\Local\Temp\2fcd12b2258a42dcc6ba61a63ddc2856afeb9cf20a027d7d12d4575be9f741eeN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1506706701-1246725540-2219210854-1000\desktop.ini.tmp

Filesize
85KB

MD5
fab7cac24fb16e031cd22f524db355ac

SHA1
4c6341c3bfb7eded651ac847501c98329b024cf7

SHA256
c323727efdc0dea25f79e9a99d3f44b2e911a89ca95b514c21c9f892ff94185f

SHA512
bb63f94f73c9f71279096a69a1a954bb029063871704407bc72f582c9c90f043d5ac9e7363a15bcac8ad6cdacc3e3eedc6db0f710ccca546ed89c259799ef206

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
da9f0bc0e58ec4a52351bf5c2a7e4da0

SHA1
cf09c2067f380d6712fcc149a1ab05b8f728e218

SHA256
5f5cddcc52fa2b7b24a8842f114d1df8ee4c7a4b3bccd38c44e36c55b14b97f0

SHA512
695f7255d157de5517730308ea843a53a2ce44c5dfbc64745dbb59c67eddcf66397f3239e0fadb32c2a8cceee79020f493c75f9276385f67875ee4a72c57fe7c

Download Submit
memory/2848-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2848-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download