aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999

Analysis

max time kernel
120s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
Size

90KB
MD5

d1d65ef7cae0b959030d5b9ea4935d20
SHA1

a583596433f1cd4564f5bde48746400ba96e304d
SHA256

aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999
SHA512

f426eb9a9971e2b1178c6371fd71494e511ed764d6945b703698e65d629a890395f49594b8f8f9248566eb09938569b0375dfc5b0a9183e297d7b960d4dabe02
SSDEEP

1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuXsJtLJt2:enaym3AIuZAIuX5

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/1544-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/1544-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861258748.profile.gz.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libftp_plugin.dll.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe

C:\Users\Admin\AppData\Local\Temp\aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe
"C:\Users\Admin\AppData\Local\Temp\aac4e35d44e30c20514ed1172e00b0aad8294297f64c4b4a3c8f02f970ecc999N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
90KB

MD5
28bee92b9e14dd5aa1a08cba73c65c76

SHA1
0995f951d25d3adef2745cc011debb3b2c8d2c3c

SHA256
901dca6cc1b8311f49be902a28e047d2b03b1f50bdf2085ecc5688d539057e71

SHA512
56233a860d55dfbbac1568bef90e5b8e57e8ad7ab7b376a7e23eec556205fee7eb91d6a024091bbb56b19f2c047eba59e971836ebf583680d7cb63ac43297502

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
99KB

MD5
79f8c07e39db0594e59a3f5d2c5d4f54

SHA1
6c2504fbf3c90ad1391f22bf7f9bd13b1d1e6835

SHA256
4e5759c497c01e86798535609f5c18c278b59a5a08c8b1746aca48075e3278ba

SHA512
a7feb637fe5f8c95dfdbafcb86cb4b9a82c68849e871e2da003bb5b6defef843aff2347e8b5a783632b05599de4a38e67b8c2c772f785599a3703fa92e8f7771

Download Submit
memory/1544-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1544-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download