1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
Size

129KB
MD5

91d3a154b37b0464afa52fb81542439a
SHA1

527d0b629d531dab91dfbaca570a9c399cb3a622
SHA256

1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060
SHA512

5a4d6e9d98e77698cf2bb92da6e447f761783a25046effc23f0e361dbf4747a94eafd45e01943bf356223f167ee5e95706437b251c337fad7f55ef5ee788f1db
SSDEEP

1536:V7Zf/FAxTWoJJZENTNyoKIKQSuTW7JJZENTNyoKIKQS3zS:fny1tE5KIK/tE5KIKw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000700000001211a-2.dat	upx
behavioral1/files/0x0002000000010541-6.dat	upx
behavioral1/memory/2316-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwmon.dll.mui.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ogg_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows Mail\oeimport.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoBase.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo.tmp	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe

C:\Users\Admin\AppData\Local\Temp\1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe
"C:\Users\Admin\AppData\Local\Temp\1a59c374b9c11d6df9aa9ce99466d9b1f6863301d3770a8c07fcaa7c40b96060.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini.tmp

Filesize
129KB

MD5
d30dd0bdb411a92d3c47aa9802109986

SHA1
55c810f308a1275495399d8c4f0a2a1523ad1408

SHA256
a8bee1e99d537ec2ce7b7b4f4c910a9041c2c40efd818f9dff9c09ef3959bc25

SHA512
816682bc77dd4462eb6a475ffedb779b7e96b9b6e3843485ed8b158878f2d0de59cb82e3ba879871f7e350baf7e41e6f2b0f022e73e7ee45599ba1d07767809f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
138KB

MD5
176c3534129d326d6b23c2a1a0b8882b

SHA1
851bd6e770a68f7856ecf2aec09249b3cccb7fea

SHA256
beaacf41a8ebf98a284154ec98c7285c78e8a0634f05f959a97e108c621605ab

SHA512
46921adc75579682064328198b5629172d0bb53cadf4d5304e7bcee4ae21a737594bee86eeef6ba72c3c971ac521cfa6e67a49c244e136f5141ac9684b6d30a1

Download Submit
memory/2316-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2316-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download