10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 13:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
Size

67KB
MD5

0f33e1d8ea1649777cc0967babc30c70
SHA1

90285f98891c77c3657e92b492f53291a45b1fdc
SHA256

10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0
SHA512

93b94d6a677a0b0a9e17879216219fd9489b30968d8b5b2f5d8a213b3a5044a0090155ac5ac38431cc1b2078a82404e4c8a900c99bbed6981160a418c239101c
SSDEEP

1536:V7Zf/FAxTWoJJ7T3cFMOu/h6HSKX/8KX/AEu:fny1bcHGEu

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3058) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1740-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e00000001418b-2.dat	upx
behavioral1/files/0x0002000000010485-6.dat	upx
behavioral1/memory/1740-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe

C:\Users\Admin\AppData\Local\Temp\10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\10b4d35580a234cb7d6ace62751dec240e90dcc24ea7c92baaf64f5d865f5ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini.tmp

Filesize
67KB

MD5
d44e1adcc18621c9917a6288e028b315

SHA1
9fa620dacc9579e988d0755027cfbef4b1245178

SHA256
9d81e098b7ae9b77b9b4816d503d3f05f0676b436a6bcd414745aac8ce9c59cf

SHA512
5bbd1390e1ec4c0504b8e09461666af83d7165dc76c044dc6434b22b183072dd70881c508f6bf0fe7e04e41d02b786823a1a29b357f2ed5f9abbc85760b668ec

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
76KB

MD5
ac1d05c66f35ebb621498facfddb309d

SHA1
b9c2de5bae77fd6fc03be4e3857d9646ea687147

SHA256
a66327732b2b9e172a28c75acaf46710f701035c82968ff07e933b8d7f0f93e8

SHA512
f06a61e724e5595f50743e30c97e00d16f232275dc6cf00df0f29f0bb744bcc54f4e314dbe4d26d091b128a666aefefaa380636dce8edddb758254befb581152

Download Submit
memory/1740-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1740-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download