f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
Size

104KB
MD5

fa0fd6bf894c2210e5230ca4cb217f31
SHA1

aaea01362108dc29b711b7b48e741e591d1b60e5
SHA256

f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc
SHA512

5dbfe965e35143809a63082a050fcc1345a024cf0b5b157b6cb25fcd517df8afdea0cd623bf41a165f2e854ddbb536a4e9d37a28de4e744e131b0ff3e15f57dc
SSDEEP

1536:V7Zf/FAxTWoJJZENTBmRPsdj2hkAeCgI3i0CJS1Il+lMLN8/O+N8/OE:fny1tEyyj2yAeCgjJLN8/O+N8/OE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3139) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2688-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a00000001227e-2.dat	upx
behavioral1/files/0x0002000000010664-6.dat	upx
behavioral1/memory/2688-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\VideoLAN\VLC\libvlccore.dll.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe

C:\Users\Admin\AppData\Local\Temp\f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe
"C:\Users\Admin\AppData\Local\Temp\f6675d860eb508f9594eecf4bed0abc727db60b0785747bf0e68f524a66e80dc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini.tmp

Filesize
104KB

MD5
7fd547cd5bb27b8efc1a6ed965ed5cc2

SHA1
5847ea4ee97f00ef706dcfc8713090e52dd081e8

SHA256
11f13e9416f5875c053a4a8a19d8c3711f3b52d003ab7e4d2eaf9a084c89c085

SHA512
9b9db1c9f27abbeb26902c224553f89d536ecf7b8009616255c0d4431c9129ed101452ae082b74ac8b0782179c4a481dd301b7a23d0d0429932d9b404fa9cda5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
0ba7e6d457766ff13370b4ab9ae3d8e2

SHA1
5bde5a52c9a1e0df07b7d56adf44f6d75b43c05e

SHA256
3a2b178fb3f57bae1f992400a0c6ba7e1d8836f45a42fe63e1f4d0d8ed4c00c1

SHA512
5d70aa959d0095759fd1c43d72a006d4cf479c118c1198a84aa3eefe90dd0e7f32d15da34343dad7c6a04563d7a31808785cf7804e93a04e2ae4a021a20d43df

Download Submit
memory/2688-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2688-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download