b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
Size

124KB
MD5

0b146056345e54ab504490e4a07fda38
SHA1

d967fe72a144c54e2edc3e888aa0f6bd180ff412
SHA256

b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f
SHA512

6ea3942b52d231df3aaf64ed5f495d9a3e5bc87782e822aa604c24e054ce4af0edefccec694237db7df5bd828a8349386100f203b739db07a4b6e81bdb48cb9f
SSDEEP

1536:V7Zf/FAxTWtnMdyGdy4AnAJYq8YqiXjTWUnMdyGdy4AnAJYq8YqiXz+Q:fnyGnpAeklXRnpAeklXn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001227e-2.dat	upx
behavioral1/files/0x0002000000010664-6.dat	upx
behavioral1/memory/2332-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Windows Media Player\wmpenc.exe.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Brunei.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsBase.resources.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\axvlc.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_realrtsp_plugin.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe

C:\Users\Admin\AppData\Local\Temp\b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe
"C:\Users\Admin\AppData\Local\Temp\b157a55c06711c5875181566a06b728049af4a4ac10454e77d4d251a66a2a82f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
125KB

MD5
42f89894f11b44fb0224606953b51027

SHA1
2b9b341bbbd7df607cd525d481c532ca297cd819

SHA256
8bd33aad0fc46148e96fb149e4435dcf94857781e8c0b2d16227400719b0199e

SHA512
3ce63cc15f17dfbeee66f6f09eff932e0956fdab70b0044b130d91f4a3e076936af0725b8f96677bcbc7a066d6af1d6bd41e7537b504422c08570d84d5d2e54f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
134KB

MD5
57ba54d35855f0923331cd716f8adf92

SHA1
e0a333c44a94a6c60aec78a075b6cf08b9ca4132

SHA256
98c8cb42cc36aacea720cb8a39636ee61ceb4938b3563a55baedafdb0c0a863c

SHA512
f0ab03ce536276c9582aa7c80f96ca65f88652634481764b97824ce301a1bec28369665d193ec5c84cbc569d6cb28b3c084ebb2eee7c492f69539439ebab4be9

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2332-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download