f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
Size

70KB
MD5

7deae22ceeadba7573dc2597d26e3040
SHA1

2b61a552709ab7171f6f09658240ff5a45c9b06d
SHA256

f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4
SHA512

dcd7ac18b757c2aac565de24f2c07cbcb7c5dcf48b04045982a3e8cf94c03c60be5e2f913f9c8c0642b53c8d646427332170c925a592403622e067d813fefa6f
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzQ:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5fcU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3274) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1656-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120fd-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/1656-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libadaptive_plugin.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcfr.dll.mui.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\VERSION.txt.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe

C:\Users\Admin\AppData\Local\Temp\f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe
"C:\Users\Admin\AppData\Local\Temp\f3c6bb27b4e3ef4e3d34d4473a90be0b8d078570fbe0eb1c7497d45b3801b8a4N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
70KB

MD5
8b6b968a70c6792681faebae70dae05c

SHA1
b35eacec876e8d40c9bc5375548da8efc225e8ea

SHA256
3d9ee3951a10bd1ae4826fe16624de1a0bd7b5488d8541b140525c8efb8a39c3

SHA512
3fbd435e3001d640d077898d7f08fd0fc129e09e6e3f249a5f82034d9a291daafa99345790ea56553f40ed9515748e2dd48b8c2a85e73be7b0cd3c391f93e5c8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
e73d190b34e14de2da7c0b2424302b6b

SHA1
8430a11ccedc2e50d1bbfa0e73bf271abdf7fee6

SHA256
6e46d0d50db272fd09d3ff21e883c5675355ef49c5050a646089180a6c92ff0c

SHA512
fb6a35f6dac43caf9725f69e789e7e785bbddc67c9b52d39780d3617104e434fadcbab1fab48b992ac1667dd4946f172674bbc3a05e323e9dd1c3f1eff78bc68

Download Submit
memory/1656-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1656-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download