d4ffb032b799a05f09ec0c50149de251f1c80b6d3892976605b45d6e7366f8ec

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1206147d487ab9a374c8e782cbba290N.exe
Size

72KB
MD5

d1206147d487ab9a374c8e782cbba290
SHA1

7d80c891085889affc57de51de58d1b8ae247ebd
SHA256

d4ffb032b799a05f09ec0c50149de251f1c80b6d3892976605b45d6e7366f8ec
SHA512

668481bc41aa206eb92348a8df06bc953a96ef4a55157aacbd9b11aebbb82dc3f05dfd96898840c8dc847eb0086f57d40e5d4c80759324bdd4621be230bff955
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY51:fnyiQSox51

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4368-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002346e-2.dat	upx
behavioral2/files/0x000600000001e6e4-6.dat	upx
behavioral2/memory/4368-1784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	d1206147d487ab9a374c8e782cbba290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	d1206147d487ab9a374c8e782cbba290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1206147d487ab9a374c8e782cbba290N.exe

C:\Users\Admin\AppData\Local\Temp\d1206147d487ab9a374c8e782cbba290N.exe
"C:\Users\Admin\AppData\Local\Temp\d1206147d487ab9a374c8e782cbba290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
72KB

MD5
8885420418570cc99815e8c14beb55c7

SHA1
c86ba675afec531db707b0968bd70afcb03580fd

SHA256
a5e4e7b7f4492d8dda4762a295b684357b1dee15c0e20242e915a80a8a26f68e

SHA512
e0abcd9681b3823512ee560024ede1cfb9f1889dd2bad5f5a89c95f76b409c14b7a0f70950ad14a442fc36d037a7528f8acb70121117034a292d892bb69df294

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
9255df38a8d51ebea15bb7f412bc8af4

SHA1
221981659dd66433cf7fac8555088c3c82ce4517

SHA256
a088fbb32def3d66cfb8e952df7015209461f64ec6eed5e9c17c1a9cc207fcda

SHA512
bc9e0651dbc8f33fa2c992d07c470ba3ee964871901f12624ddf357639905c4da2f32ce1ccec98ad6b6e491f446c2c89aad55773370f383014e15187d4021833

Download Submit
memory/4368-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4368-1784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download