0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
Size

95KB
MD5

757ca3387e7c8667e1b7735726370df0
SHA1

9ada0b8d4aeff9efb24505658ae4687ee9c4bef8
SHA256

0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3
SHA512

9cdf653868d3381b82c4dec8e5aeedee9c79d4cdc575eadefc798c315ca66aed0b48be063b202b0a364b00d0e8c52dc35cc50ab591cdb4315fc48a6a616966d5
SSDEEP

1536:V7Zf/FAxTWoJJ7T4M95Cftua3pDBhqGkFZAqgZ+0ZHn:fny1UMxwpDaG6Zdg80B

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (327) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x00070000000120fc-2.dat	upx
behavioral1/files/0x0002000000010420-6.dat	upx
behavioral1/memory/2248-22-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_SelectionSubpicture.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpn.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\desktop.ini.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\de-DE\DVDMaker.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mip.exe.mui.tmp	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe

C:\Users\Admin\AppData\Local\Temp\0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe
"C:\Users\Admin\AppData\Local\Temp\0beea866da30055fba3be2a299be0eeb7427150bfb5e0f36b6f74858f80877a3N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
95KB

MD5
04f6c76985e34b7bb87522b0c4a68a39

SHA1
65d340387de64a2e88188f8ffb91dccb0f9dfda6

SHA256
d7b7a65ffdde874080e9399fc3f38601c6814ca3f867590abf04685b262c3e39

SHA512
601ea3f445e9e0c23e7bd950a4529883f853a37aae684028dc667bb0a859622978e74da2ea94aba57331b2f08c688ccc590ec2c8e826fad87166c0aa8e78b801

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
03cc0915abd1ac1e7c4e10b8282946d5

SHA1
2830ea0c41903ca92f0d46802c4cb3f2b56528a6

SHA256
1b3927dad45b039e29fd07b0518b852abc5756af0d2797f3c5b7ef96b2933b72

SHA512
9919cc6aa2959f5b49269c7ba9f861c8c750d4b236dcf1f928a61c5e17b28103a6ebc385532b39c4dd5da02f968ff76aa766f694c9f05a4f6c813d58f6f55ab8

Download Submit
memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2248-22-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download