76148e45f0715a6846a31c5e63284255e7a12667f3a998dafce77525e7808a6c

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1d1df7e76e7beaf944fbc5c77b58250N.exe
Size

87KB
MD5

d1d1df7e76e7beaf944fbc5c77b58250
SHA1

92c852b0c5b039c87f27abf78b996977a506cefb
SHA256

76148e45f0715a6846a31c5e63284255e7a12667f3a998dafce77525e7808a6c
SHA512

bf0a45a2684ab6d4349e33920233db2e2cfa8069ea82c40318505f2edfb8c3e4664e0a1f48405cfa2e23b18d3ae8c1fc8bad49fc9efb74ba5b1a9d6f69923876
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8X:fnyiQSop8i8X

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4352) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a00000002344a-2.dat	upx
behavioral2/files/0x0014000000022946-6.dat	upx
behavioral2/memory/4936-1784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-interlocked-l1-1-0.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	d1d1df7e76e7beaf944fbc5c77b58250N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1d1df7e76e7beaf944fbc5c77b58250N.exe

C:\Users\Admin\AppData\Local\Temp\d1d1df7e76e7beaf944fbc5c77b58250N.exe
"C:\Users\Admin\AppData\Local\Temp\d1d1df7e76e7beaf944fbc5c77b58250N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-47134698-4092160662-1261813102-1000\desktop.ini.tmp

Filesize
87KB

MD5
55078368cd71f4f77107bb36d07c8ca2

SHA1
3c77cef738184a7c866858c57239ad7916bdb057

SHA256
105969193532cfae637fce1bce6402c35adfc3dfd1427c38069a4d9889ba69e5

SHA512
75a7e26f3a18c89f068ac571dd25fec67529b784fa4caef5a3fd0d2021607cab4828726ba5a0ca0201910e622cb8dfc28bb36ef1f661c093d046ffbafdc530cc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
930ab953a5d03f731d7090e39efed90a

SHA1
58f6e63c2b37fea9b12ad9af0dd6d72e91cb863f

SHA256
7b849bcceb0a04f8d2fb48393172ac96c2ec64a8041153883c6d6094567249a4

SHA512
59e4eca12f7ef331324cb8b84d868a21e917456fc06e678c41310d89a8cd1a9581ac406ced1350d9a4c684897add8a8e114e8633912db4c40eb7073c33010197

Download Submit
memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4936-1784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download