e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190d

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
Size

97KB
MD5

a95d34892d97e219b895966ac1079f10
SHA1

564520d99aaf11f5c8541ede84855c0bba4b10f1
SHA256

e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190d
SHA512

d4f0ca91b77e9787fe33e960d15cb1e4148ac6412adda4cfa921c88e06aea68434495cff669998fc5f21b8f45adf2bd467fbb31b42178d6e43b6fbc1cc5760e6
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgLrdqduv:fnyiQSoFcPdqduv

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3083) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c000000012243-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2204-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\InstallReset.jpeg.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Madrid.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\ExitSet.3gpp.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-compat.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipBand.dll.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\UpdateDeny.wav.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\bin\j2pcsc.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\UnpublishSplit.inf.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\Chess.exe.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Microsoft Games\Solitaire\en-US\Solitaire.exe.mui.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\flavormap.properties.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationBuildTasks.resources.dll.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe

C:\Users\Admin\AppData\Local\Temp\e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe
"C:\Users\Admin\AppData\Local\Temp\e4f364a8ba9a31f612eeb0dd066cad15ec4f0b22912a007472f689ad806b190dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
98KB

MD5
c73f6763cdfa491d587d733e4ad9cc24

SHA1
61bae37dfbdd71ce2778f51c7c75d551bed6c807

SHA256
4cf4d9171ff48f6766a5190b45492f8b41ca93ed043633f77fcf81f8d8a886b5

SHA512
3704d4b05258b34fdd5d85121fd1ebaa740254deac59bbfb93cf70bf89b27fd8145e0655e5ea285f7847e6d3624e6732d85496530ca45145abfa45551b80a339

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
107KB

MD5
49e7aed8ca8c05d9b1aadcc55852c8d2

SHA1
0db37a3ed22d2bb60dd061e684915339886c70f2

SHA256
ba4aecf6be947efffc85fbeef0d8660713c1d77ed71f3dad4098e1bb78290b75

SHA512
62339e4e5d392a4e9f8aba899ed60ce13329a37a815963b638e97840dd983ccddc1e81438c480eff0cab5d83fcd385523a78c70bc2e2fcaf1c6f1a59325f1cb2

Download Submit
memory/2204-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2204-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download