94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
Size

87KB
MD5

390e4f5683bfe95c2971fbbb0a7a2e70
SHA1

4dd65561396e6b758d3bfb916394d8d6335406b3
SHA256

94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717
SHA512

1b8311b82fd93b012febf2f3ad360ed2042d2a57fb95e5a49725d0e18c210c4c63edb8a95a8fa9295d8e967cb0354e9a97df7909d46415bfbe9a4bf9169f0079
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5KwV:fnyiQSox5KwV

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/848-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/848-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Stockholm.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Perth.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_zh_CN.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\bin\t2k.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe

C:\Users\Admin\AppData\Local\Temp\94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
"C:\Users\Admin\AppData\Local\Temp\94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
87KB

MD5
3bd0d919c0939fba5e2638cc4634b497

SHA1
6a7e79ac10b0d35d993167c894ea7f98472053ef

SHA256
8230d8bb646e22c13524517aa80088406fcf3d20f1eeb6f387e3505fc4e11eb1

SHA512
ebd8f82dcbe05a9aed98b09d3a56cfbfef38f1382f3cfd3f56d31a42629d846673d5adde613cc3946646e3e6e08f2845743d58fc331001f754caad9897ae7a47

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
96KB

MD5
9117003bc6cdea0e32bf6835af6a7da4

SHA1
183a40a8b4bdabcefab91cc432de8bbe82721c90

SHA256
89fb74983bec534b33b0fb0f26bc407b33760638cea7a08b9b176c320548733c

SHA512
e449e81773b09325f321d0426aa7a20d1af320d2efa0cf158ca53d961b90fa05f94f0a3835a79aadffbc900bd33221b3e04b7092657674f3e0f00331018684b6

Download Submit
memory/848-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/848-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download