225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d

Analysis

max time kernel
120s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
Size

144KB
MD5

7a09b621000c01513a00a7f0f2cd7d71
SHA1

f98d27a9ea192b71c123c58f92a0b9b2a057a319
SHA256

225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d
SHA512

b984cdcff1780146c398866b47e46110cd8a81018c8c86af60410510b1bc8129c846bdbe02fccacbd1ac08d974d7294cb87bc440d8b960d2114f932c06b10dc1
SSDEEP

1536:V7Zf/FAxTWoJJZENTBmRPsdj2hkAeCgI3i0CJS1Il+lMEacCy8ZgDMEQtDTql7CZ:fny1tEyyj2yAeCgjJEfCyDG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2727) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000f000000012782-2.dat	upx
behavioral1/files/0x0002000000010620-6.dat	upx
behavioral1/memory/2404-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\jvm.dll.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-awt.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Irkutsk.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\desktop.ini.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe

C:\Users\Admin\AppData\Local\Temp\225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe
"C:\Users\Admin\AppData\Local\Temp\225902f7669635ba3ec3beb75e781b124569238d3bd04b0294ce2112f6b4010d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
144KB

MD5
0ae8195307d66e5b7f3d2e9369b249d0

SHA1
e9a6075c1c5f14f72794a107f8a97682e643f34f

SHA256
ceecd01a575ccf9878204ef837c8d0388d0391996fb953cf206d5c88fee9c3b8

SHA512
401a4fb770f4a33660a9019d828d173fb77c07c953b2be879c0cb6176b972422276d7cef8814dab9b13776d611d9c4cf404483709cd3971ab750e0f4bcd34356

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
153KB

MD5
51de8f561c2b3e6a009e7d1a5b52c1f2

SHA1
d005d45b557367ebfd43fb87411d09e0eb889fa6

SHA256
f158cf1f6f661f38d61642dcfef1267ac4c813e2d4f90899f54fae7afac32af7

SHA512
df7e9e0adcd75c7cbf4c901bef42a68979c1887ed7df0eb42d3c216603f841997475ddf851f708cbd5d078a66362271380d1283df58d1f17e0f3cb60ba175a40

Download Submit
memory/2404-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2404-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download