00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7f

Analysis

max time kernel
150s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
Size

70KB
MD5

baa579e6e1bae7ccb0ede66078651180
SHA1

4aeac75a9d2129523130393d5983b1d1df503c1b
SHA256

00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7f
SHA512

a708e30d20755b39680466dd73d5e65d5972cdaa3b54e4020be51c14dca2bbb2df08273e285cdabac727ef76aedbd966942248e1e63810666e55cec7a98c3e72
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/ti97o1LDdu:V7Zf/FAxTWoJJ7TTQoQ2Ls

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3740) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/2776-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_flyout.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\MyriadCAD.otf.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\library.js.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\TipBand.dll.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Porto_Velho.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Design.Resources.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\ITIRCL55.DLL.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe

C:\Users\Admin\AppData\Local\Temp\00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe
"C:\Users\Admin\AppData\Local\Temp\00ee25ca13b52fed82f9d8cbd3f40b9f0db7026092cf5f7ecf7c64e049a09a7fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
70KB

MD5
47c008c76b788a7376facaab0eddda85

SHA1
dd419e6b32d7bbdbe599c9258621212c3f350b50

SHA256
3d0b75b9768b2999b1793aed41ddd1912ba87833fe766db1d737ccd73e75e63e

SHA512
0272983bd15d7f81cb9ba414a99b243595322f1c84cfd56c9a7207ccf2915444370ac4a57322053065c116f94260162e18bb5f765d1b78539d93faeae6c9b723

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
79KB

MD5
8bf78fa0d96f341b84c08aa398048e24

SHA1
2ce8175f7330032caca2aea98edaefde2151cefd

SHA256
28279f5b3d86f83b3b066c271a487c04da00f13b4ae9e4f0b96acddd8e21f664

SHA512
1f4bbf78cad109cef4004361536d6e41a52725a742c9510672e84b8ac82b9ca62852587702ad90f7f41bc6be6395dda45087d1c64cf68c0a241206e0924de3e1

Download Submit
memory/2776-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2776-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download