f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4ccc

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
Size

58KB
MD5

fde751d4870de1b8ed8ef231d53746e0
SHA1

36d9e1c5171afe50d5818ec01157470ee72a9175
SHA256

f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4ccc
SHA512

579df03f73c85eafce3c11bfb9b312bcea5120fbcc1c31e1204200c9d8777482155560cd9304b39cca1cba39e622ad7889e8192b9f9252b2005edd7f11462ce6
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIb:CTWn1++PJHJXA/OsIZfzc3/Q8IZTN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d00000001226b-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/1940-72-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayman.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Mozilla Firefox\nss3.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Antigua.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\MET.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Christmas.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\README.txt.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunec.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe

C:\Users\Admin\AppData\Local\Temp\f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
"C:\Users\Admin\AppData\Local\Temp\f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
59KB

MD5
43effc62b52d02eb885bedb88a3dc282

SHA1
54958e79481ca390024319baade6a8f90b1a0107

SHA256
d4457d35305b560149a627cf8f7d16295224342daf54c7ffa8f15db1e98313cc

SHA512
b74973d6d02cac222c01eb9c702995adb07fdf261362b4ca365714109cf92492420e19a29c86bdc35e10aa151db33e25d55dcc17ef5a7ed3fd1e3048bdeba515

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
68KB

MD5
7f9511f55d3162b4199320ca3239d327

SHA1
458a8a07fc1d6928e8cb8385bec130eb1973684d

SHA256
014c9190e8c0785d6ad7c1f1c4fd44b21c34068506251dcecc2595b12efc5c60

SHA512
147cff0b8ad26f18dc136a48aed959a625661bd09093dfea74fbf4bb01eb9bc70486514de1a58ed3d8aa7887f7a33eb37c1ac949f140e776d59693e3d96a16f0

Download Submit
memory/1940-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1940-72-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download