c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3a

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
Size

92KB
MD5

93ff86dd58c0cc1697d2b227537a0100
SHA1

0f8b0072e8ac2a6d38fdad52830fa1dfce5dba47
SHA256

c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3a
SHA512

48372e377ea8348701e21f94d9f42af4c3da78e707f78ea20eb2975d5053237ee0ebf38dc7740b6a042f85464ad35e2b0c9fea8de0311544eb9907459ab0ef55
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5RPWG3PWGL:fnyiQSox55

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2852) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2456-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211b-2.dat	upx
behavioral1/files/0x00020000000104da-6.dat	upx
behavioral1/memory/2456-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\net.properties.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Samarkand.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jdwp.dll.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe

C:\Users\Admin\AppData\Local\Temp\c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe
"C:\Users\Admin\AppData\Local\Temp\c4bd189bb6e8a78a0ad1fc77e42d83ac287112b3259ab3e3c546d8fe643cdf3aN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp

Filesize
92KB

MD5
f86829d45063cfda09c14808db84e96a

SHA1
9e71e65639434e88fa968bfd16c0492810eaf6f7

SHA256
a5eb0234c41d8ada9a6adc152bf74472f954ce181f5a190d47fb2bdb3f40fe47

SHA512
1d6ef1ae360dc38aef2496e6d15ff0e2d77a87ee86c9b60044bb821a1b695b026bd996e9b3aa1841e3b0e016ca7a9fa7bc9ed612f915f5f179efda3fee71fe39

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
e88f5cb4f33bc736cbbfbdb786dd0f0b

SHA1
5d9a8df8c91a19f317c72bfae9a73e12ef11ef1b

SHA256
198275d07795a46bc8fa89b8e41236c2d9ff13b3e5e2b47431cb205127d0f3ea

SHA512
85006948a79867dd2c6bcabc0ee2eaf2e3af7a238af5d114db4fabd5ca7115522c1804142697a7c0d3278ea64b313e4d471f53d8a02e7dfa3485828272cd9adf

Download Submit
memory/2456-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2456-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download