a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
Size

35KB
MD5

c3d77bed1bc4df982849b143f48bc880
SHA1

cb663cbce1b6b71f756fa44a2c0bb6b9eb0f19a1
SHA256

a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8
SHA512

5685784a336aa921fea954d2096a1bde2704d90258a02009adb15a7160c150507065324b0db2fefb8fd3b829ac2aae119659ea6af1a25512a5233c5d70ab99bc
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJD:CTW7JJ7TPUY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3384) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2248-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-favorites.jar.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe

C:\Users\Admin\AppData\Local\Temp\a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe
"C:\Users\Admin\AppData\Local\Temp\a83b3248df3b7c95a4c9810eb25e7bfadf85ee16722eff0a22df331bc62249b8N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
35KB

MD5
6493edcf087182a696f40dd9a43499e8

SHA1
800d97aec3ebb1870df0bfb4d1776057d2af5aca

SHA256
607866b1d90c4e1bb6dc28777552850b98bb276e6c42ce94224dae7fd54f6e0e

SHA512
c6eacacb9bec8d475a7ebbf9a31f6e41f32433b4211ad141ed44ce251df6cf535f02c8221dfdd3aa01859c20a85da502104f69b09f4217ed879a870b1a28c1e2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
44KB

MD5
033dd472c7c2b760cdf8eda5a9742df9

SHA1
3ec7afff9628a90029ea632cdb9b32db85ef86b2

SHA256
6e6cc891252d9a9840da88834989a4c644557f1f3659838a1c59d3bfc58201a6

SHA512
602a1c184666ca324ccd97d3300ce79865e9bfc2179a8f9ee907160dc6918915b9f2c172b1020d68aaa8b88e4fa453db17a5203a4b39d79ef538726584843d5b

Download Submit
memory/2248-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2248-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download