0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
Size

62KB
MD5

4a322cedf58eca107c85e665d3bd8490
SHA1

e8694d62d37fddfb3ae2a87b557dfab4f333c11d
SHA256

0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620
SHA512

3a8d74f3593ed69c13ee00973b59ff911a4964d410f10478229c17f09055c53e812b365d386054f12c64c35e06441899d7c2a36bd3695ac32def13295420e1f8
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJcbQbf1Oti1JGBQOOiQJhATBmK4K0Jg0fXoy:a7ZyqaFAxTWbJJZENTBmR20fXo13rIAI

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3279) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012117-2.dat	upx
behavioral1/memory/2400-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000200000001067f-6.dat	upx
behavioral1/memory/2400-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.ini.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libimage_plugin.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Mozilla Firefox\softokn3.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe

C:\Users\Admin\AppData\Local\Temp\0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe
"C:\Users\Admin\AppData\Local\Temp\0abb6edb0c7176b8949ec31958de67f8a5868acb342d5997bd4ad28348203620N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1488793075-819845221-1497111674-1000\desktop.ini.tmp

Filesize
63KB

MD5
c9f48bb1a842ff7cb33aac48249a949f

SHA1
fd9c0d75a55c5f8dd5155e7fd802909ffaa79dea

SHA256
cedeb6e75904242aac76c3061600d1f3e3818c7cdd08e1b15b50241a90c8c5bb

SHA512
ebd7f5b7be6102967545a355d2cb38b50557a12f4686d4421a0b539fd74f491b9562451ceafd788c51cb3368334b810ae773b4c0e05f851cf0525e5302611cd3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
72KB

MD5
8490249707c54acd55e7f1b45f5c780b

SHA1
d274ddeefabd1abe86794d004ceb8f8918c6351d

SHA256
49c3e0b212b0488ee60c9f60d63c2e45841438db1a3ad0822dd5d6e6a4af9a51

SHA512
cedd1851df4bd66abe2b152a6230779b72569f9003809dbc44901c9604edc8be19010ff81a814cedf4e8588d5debf5a600f7700401b1daf9ddd90789613da081

Download Submit
memory/2400-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2400-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download