f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466ea

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
Size

159KB
MD5

7c9203dfef9f8a0e929cf699c6c08020
SHA1

45c6e7d537e457855dcfc55353af6e165a2a7e66
SHA256

f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466ea
SHA512

2db8ce22745345b536fdc4121c57a489c7c311bf9fd1354a08660597537cde45eb8ecb76396f1690d35be63fc791f0b45c884a0467dfc23f46199197379e5592
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgLrdqdTTWn1++PJHJXA/OsIZfzcc:fnyiQSoFcPdqd3QSoFcPdqd9

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3428) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00090000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2308-72-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Printing.resources.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Mozilla Firefox\IA2Marshal.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\desktop.ini.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe

C:\Users\Admin\AppData\Local\Temp\f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe
"C:\Users\Admin\AppData\Local\Temp\f1014c2afefb53d60a2348f76cc3f2a3ed11e9f2ff48b2fbb28291151f1466eaN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
159KB

MD5
7836dc7d097535fe5f36957842562e22

SHA1
7f200c9d6e9146eabdc25d9ccec50d30a6582098

SHA256
0a1c76660c5ef1b32ab85e857ae54beab57cd2a86a82205f24122e06581f1404

SHA512
80dff33ff3991bd44d6c89af545f4bc1471c5e8e4b016a85397033d76fd7609f1009e80c35429006f06bb79e3ce2ed5ba0f7933ca63313655d33a643db6b409a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
168KB

MD5
33fef9518eab4eaf72a452c9561e9d0b

SHA1
1720e652d4a3eae817eff567781c5f420f4db96e

SHA256
adf48c2d364ae272c4d8f4dece9619bb81c12fe95ac79efe54433af0d95468b2

SHA512
fc3e4361ae404bc32e777e50c7de93574f1729e6c3ffa015e4d1861acca4595941d3168d18dfe02329c36f3d0f533f77019ed010e6804d7e23a2d7d94ee79afa

Download Submit
memory/2308-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2308-72-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download