8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/01/2025, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
Size

209KB
MD5

4088c7c7dc7c8f0ba5497ceb9cabd690
SHA1

79ee0a4d36b3714bba4a57ae6d3e9cbe3f0dd9d5
SHA256

8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567
SHA512

dd45562a04b8832fb2146e9bef56894c1632069f9f7006900939a5d335c52c7bbea205a70845baac099a96fd34ef52ef9d6ad4dbd038bcc0815f2589b95f74fb
SSDEEP

3072:fny1tEyyj2yAeCgjJQWHIjN3tj6qnv0b2UrXkbvLiPB:KbEyyj2yAIJbIjNDv0bNXkbvLiPB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2695) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1272-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0008000000012102-2.dat	upx
behavioral1/files/0x0002000000010621-6.dat	upx
behavioral1/memory/1272-70-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Glace_Bay.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_zh_4.4.0.v20140623020002.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe

C:\Users\Admin\AppData\Local\Temp\8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe
"C:\Users\Admin\AppData\Local\Temp\8ecdc1a98eeb8a07b6b1ab22c08d8f360b2c3dd141ecf9f8b781660a3c017567N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-312935884-697965778-3955649944-1000\desktop.ini.tmp

Filesize
210KB

MD5
4c84069267b38759a094adae7dc065c3

SHA1
e13b0b1e37e37ded513d099183afd02a06928333

SHA256
cd8d047d9cd2184f8f71ecdbb6206f67adb9704c8f2d3b2dddfeb1b858b252eb

SHA512
2233a78a9e02831b16a9648a414a17634e23fb0dc1c48f208076894fbc224a20d1f6ab4a2b8ac5994c95f82e069714cffd2443e19ace839a171280313b014334

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
219KB

MD5
df15bf9ad7755471f8ca5d262b3aec12

SHA1
e622d17e97a9956354eb82db242ce5839f96fdd1

SHA256
e666c88ad39af28b8a71f07e3d65f1635ff4b11bf526d451c872e82a5df4f952

SHA512
f04ca2bbfbfbcd6eee1ca687fa7c0435383583f197ac7595836e7872efcca8f48386ce78960321053cc1616376c6bae7fd294dbad2ff54716b87bf5b4e065f8d

Download Submit
memory/1272-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1272-70-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download