a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
Size

54KB
MD5

e32b33f0ed830a2bd58ec865b9a5f8e0
SHA1

2d3ff04161198e646ac41de1b312c18f13a9e46a
SHA256

a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1
SHA512

6d46719b6256af6f5310734a51b855d1b1c54ee329c9d2994963cff7762eec1fbe1c231e589002dd191e56c4898d73a5faeadc1cdddc546e817b0c77496127ec
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI96o+QOViJfo+QOViJb:V7Zf/FAxTWoJJ7T2UA

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e000000013a51-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2416-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository_1.2.100.v20131209-2144.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libsdp_plugin.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdav1d_plugin.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe

C:\Users\Admin\AppData\Local\Temp\a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe
"C:\Users\Admin\AppData\Local\Temp\a0cc74ffa4d469e099f5c620b7c2ae86d0fe188430e0c4b595a690eb3f3c1da1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
54KB

MD5
924101beb37f2d91b7b11a860b9df93c

SHA1
09e68eb2d692ca5bf5b7099fdd792c7deebf0f7d

SHA256
4a714f0cabe86a1020b72d77342f7db703a8e38f8cf566bf3d7524fbd49bef41

SHA512
95629b1c56d5365d59a7f96be230ec90033314817c07eb7a8f643d3e8d237e03eec0a029cb4043379cb4312e2d1db436acb7234dd86d8fccc579a79463075434

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
21b53b3305c8696b16b7d17625e9d4ef

SHA1
e9660e54363a2d00df651d6e936a5ae4f36b803b

SHA256
d1e16d3552e87f6ecf7f6982d3f45f73e0823ddb92893a2c7ca103277e98ae7d

SHA512
08d48e2b4ebeaf86c0d9170e350a2304949ce8af8df50f9ed8562cadd5654a9b49fe637d1332bfaec8680f8c009decb0e84b1f0804ab95ef1b1368de394b446e

Download Submit
memory/2416-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2416-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download