d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
Size

184KB
MD5

36f20d92558796a78602a93c8d853980
SHA1

c30c9051fe991f1b33c857660e338a4b7558d84c
SHA256

d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9
SHA512

eaa1555aaf341650b5fd2aecb9ce30450bedbc88f6ae0c2cf025e1c2aa90d8430ab0ae564e8a9c2cd2f438a9bea9eb3863350452607d211400e9e84eec5b4294
SSDEEP

3072:htEyyj2yAeCgjJQWHIjN3tj6qnv0b2UrXkbvLiPw:fEyyj2yAIJbIjNDv0bNXkbvLiPw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1836-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a0000000120d6-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/1836-70-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2ssv.dll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe

C:\Users\Admin\AppData\Local\Temp\d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe
"C:\Users\Admin\AppData\Local\Temp\d4e45c617df6bb1a8a7df46392497e43126e4940083e779de72bc435b4d310a9N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
185KB

MD5
edb6994bbb0128cf6c6d995e10a73a0c

SHA1
1a9509da0c4fb609c946e1a72c5393067452711c

SHA256
1af7231c55c4bf3f1a2f6221b423598531116d40cca13f6eff28ef31fbb477ce

SHA512
751c11a9dd9df40cd24f6c44614d550bb8a7640b8183d5ea38fa651577fa4cf2a41784c30dffd0fed745e39c5bc7f4b19aba442692d512f25dc27fcafcf3329e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
194KB

MD5
3f557866f5d91a424579c245d3a3e281

SHA1
b37376749c763606b728e36c3544b4b50bb3de71

SHA256
4bf986e4dab9cd97423ff59134c066afba9c819d64ab14ef59a3004e4bda9793

SHA512
16078292f11e46bc9528e27f9948b8e593da784f5ec8a6e0f6f990a8f9a0d887d18dc21ebd57a1cea14c3ece2aa61e40cc1f321491bd483a37ee7f3b4f141122

Download Submit
memory/1836-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1836-70-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download