4090afef14f5e010733f4e94a814fc76bc5fb80b4eaf59909a6d3d4fbc63f2e8

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60023bcb4cf1899dbb81084ec4cdb480N.exe
Size

85KB
MD5

60023bcb4cf1899dbb81084ec4cdb480
SHA1

8a97f17720dab739ead0c78b42fbaf30bf87b8a2
SHA256

4090afef14f5e010733f4e94a814fc76bc5fb80b4eaf59909a6d3d4fbc63f2e8
SHA512

bbb782dbe3e6d68319855d1fd3ba4eb8a778ea0e7f1760fde05de74f275b693c562e082ddf6a289b5d2c192ef9982192b17b08112c58bee7a826b316962acf7d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2ry:V7Zf/FAxTWETWMAI

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/928-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000234b8-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/928-1786-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\mojo_core.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ru.pak.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\fil.pak.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	60023bcb4cf1899dbb81084ec4cdb480N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60023bcb4cf1899dbb81084ec4cdb480N.exe

C:\Users\Admin\AppData\Local\Temp\60023bcb4cf1899dbb81084ec4cdb480N.exe
"C:\Users\Admin\AppData\Local\Temp\60023bcb4cf1899dbb81084ec4cdb480N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
85KB

MD5
eb686fd9e8a6b3c8a1eb550c6bd9afd4

SHA1
104a6799ed2b1a31cc125f88590c868c1b2d5d50

SHA256
8fe7db0d06f74f25086faa6feb32c0f92eb34bae829c8b7cd29566dcd3c315d2

SHA512
aaa068a0aa2b9423d7800dcf1ceeb7ef5cb375957f6363a6409d623c3ad73e317186018ab3b0c7284343555ad6d3f1f806b56ec2e7e9488309fbcb84c9114f4f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
7256c7441255087a6037644f6541bd81

SHA1
310b3675a1bf89bba7d6e8ce04a14927b436b7ec

SHA256
8c380aa1dda55c71c8e1fe4b7db73739853b7787bb8162b81b26dc3c353ea2f1

SHA512
c27165ce0c4e632f0ebb11fe17abe14f9af6c4167b600e31ba395e829f185a1ba817ee6b04a6c6addad9e354c11535ddd281d354e6089f21f33c1c4c5876e983

Download Submit
memory/928-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/928-1786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download