43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
Size

281KB
MD5

b71ebb681af0ff0d0eca0d2b87785928
SHA1

84d4359b96869916cafb46f0455f67a2f097198e
SHA256

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1
SHA512

03ebfd885f81f5789b58b9485c144aff1598c0a25a9584c6de779401f90eefd39b730cfb01e006d506c871a0c8c63a9bab4cfee7f41270244c1dac0191581367
SSDEEP

6144:fEJIjNDv0bNXkbvLIEJIjNDv0bNXkbvLU:+IZGNXkbvLNIZGNXkbvLU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1726) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x000c000000010546-6.dat	upx
behavioral1/memory/2244-59-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.bat.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

C:\Users\Admin\AppData\Local\Temp\43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
"C:\Users\Admin\AppData\Local\Temp\43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini.tmp

Filesize
281KB

MD5
df547ca7bdf2d7145fd1ac574621bd68

SHA1
fb342bcb540e4838c84b89d0e9e6bc27266a904d

SHA256
5ceef87bdd1ae29a970d90674fe146d8f0710a3ed6de99e375eb03602be5f68f

SHA512
eea9c147f765b932ed5e1199e1de177158a055fc4d3a288b76ccecf34dad25a3feef5196cbd943bb94fec7a65f1ea59e1dd9fde62401b866dcbe20b7821ec21c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
290KB

MD5
2fa9769abd9e8518cf745e8fc886f6f6

SHA1
04643480eafa80fbfbf83ff8d78d5ab2e30c41a0

SHA256
f3858886ffdc059e9fad173f5408a66a0fdda0fe2ab6d41c18af219bfbd419c1

SHA512
d4783dd88875f83867a09e372f5186237329d87849c6c9d8c91c39c037ee7e3949bf5d5b041a4b265829e2c6708b1ac87bb03002b19687a90d4e1f489a329cc6

Download Submit
memory/2244-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2244-59-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download