014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
Size

390KB
MD5

9e286dce2fe2ed3c19581694ec1e80ff
SHA1

f67813c183e2e553f3238651527ef70ab51c1a66
SHA256

014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1
SHA512

2ccf0339b74f32dd8f469378bb3e2cd14301a269e7cbd03587f87f0f0deec95d65268f5aa3106be91a7492cedb6e8505116d1843ce666aae561ac9816f660de1
SSDEEP

6144:fEyyj2yAIJbIjNDv0bNXkbvLiP+Eyyj2yAIJbIjNDv0bNXkbvLiPtV2t0:PyAUbIZGNXkbvLpyAUbIZGNXkbvL4V2+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1571) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000012116-2.dat	upx
behavioral1/files/0x0002000000010664-6.dat	upx
behavioral1/memory/2292-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DenyFormat.inf.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\ConvertFromDebug.MOD.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe

C:\Users\Admin\AppData\Local\Temp\014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe
"C:\Users\Admin\AppData\Local\Temp\014f1c13ae7593bfd3dc71c58c3cc2e273b7e00f24c7bf779698466af1ce87f1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
390KB

MD5
feb9b92cedaa6994fd96c12d9e8d9f9e

SHA1
162636d608f39bde1b5d0ea137a139ee13c69791

SHA256
4de67938f203277f27eec408f7c25f3b2977fb42d7e398ba571b4b067cf0b8e6

SHA512
1139f1e450f3b73b0f26fca85ba463d30c846357531bedd8e3925f41ddbdb0592b7b679e5eea7f6c3c5a9620902fd622822b8d7626fc0824d9d312b21f328d0b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
399KB

MD5
a7ef60b8ef0d1757725bd6164bb94a31

SHA1
2e2be1bb78cceb8ca29f333cd146dcf9b25127c0

SHA256
a877be56955711ea756b8f4239e01797cccd52360e30d309f395436eea818571

SHA512
97232c67ce19326832fb27274a14d8400d84e38762555402bb450f1e97351e07ef19e811d5a22171c87caa3aa2be43fe93bf2e7cbe9e44fa4d35a893cf7b6abf

Download Submit
memory/2292-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2292-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download