345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
Size

42KB
MD5

7ebfc337e1189d096c6640c744dfedc4
SHA1

68699c53f6df6e16c28b4206045a910bf5a113f7
SHA256

345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5
SHA512

e349ff0fc18cf48ff3889f3f214b0045a71fca1c969b5714d9f8c8a6016633481dd825b9efe4d27b5eec575ffa3e55df22fa08cc2ee1fe44b6fbc280482ca54c
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJqWNzOZzOr:CTW7JJ7TPUnWwMr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4040) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2364-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2364-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.ELM.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\chkrzm.exe.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Zurich.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Defender\MsMpRes.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\bin\jdwp.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\micaut.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\Office64WW.XML.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe

C:\Users\Admin\AppData\Local\Temp\345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
"C:\Users\Admin\AppData\Local\Temp\345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
42KB

MD5
3a39db8a13f5d05435112e7189c6757b

SHA1
928c2419b11ba31077139615a406b336fa8464a4

SHA256
d99c6fa417f120f422db83e3f34f7325c32f9ce25679e120144514fcbf361792

SHA512
0fe82e9949f33af9f5099c9ea20ba0329b1a748c09a50200c6c0d5f083ca4b28ef19fcfd4bd50445b3b283c6d7b9c3f1e16eefa9339c0e37ac555c7f93e1a197

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
51KB

MD5
4f96299bc2177b2f51f2b722d5208cc2

SHA1
1d31c00efb36fb3a37d245566bee74846dfc4f38

SHA256
baa10c680e92c7beb4cb594a711c1243736c2352a197e6ff0833367bd1464128

SHA512
026ee845b13c6e74fd9200233ec8d6d22facc04af282a8fa391ee5046e093116c3bb9480bb3a89246fb773ab696a6100c016abf1527f304d0dd9699b4d690072

Download Submit
memory/2364-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2364-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download