b01299f3f52a32ac79fc1be02916edb0d001897473159da29d1b615f5e8297b0

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 22:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61b336974216d0e7c710b704a2169e20N.exe
Size

70KB
MD5

61b336974216d0e7c710b704a2169e20
SHA1

bf93d7a996255c3fb48c3048e8d56ab3a83036b7
SHA256

b01299f3f52a32ac79fc1be02916edb0d001897473159da29d1b615f5e8297b0
SHA512

be4673607991d79a12ecc72190191cfd617e093ea9d7a8a3b79a52efa11b158087a595e3af694859f0ab4d3bcd8319689cb502221988211f6c72df6b6d12ccb8
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsK8/8H:fnyiQSohsUsxkH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/892-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233f7-2.dat	upx
behavioral2/files/0x0014000000022905-6.dat	upx
behavioral2/memory/892-1624-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Google\Chrome\Application\debug.log.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	61b336974216d0e7c710b704a2169e20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61b336974216d0e7c710b704a2169e20N.exe

C:\Users\Admin\AppData\Local\Temp\61b336974216d0e7c710b704a2169e20N.exe
"C:\Users\Admin\AppData\Local\Temp\61b336974216d0e7c710b704a2169e20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.tmp

Filesize
70KB

MD5
495fb8b5fdd72c76dd1d60fccec95c66

SHA1
aade60b49432562414bcf46e19ad36769606dc49

SHA256
197b49401fef742062985fa4cfd36f6dc05fe680d0a3b8c138e0e17ceabd615b

SHA512
972b236ed45c98f8f799728444a5b4b0b3384f18e982e12183571ceca5982aac07cfd655d19707607125baac349db40fb01aad9ac0c35bf25a8051dfc70ea9f4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
97e1c608171b2205fb2d3e893f41cb39

SHA1
8eb253b3124e2c6c8abd599ca40152b35db889aa

SHA256
c8d0c095ccadf0625dd3a07e7466c7e021e84cd65e8bc929c0ebf83599ec0092

SHA512
cbd1eded9572bdaa976bc373d544085e8330b244359b128b78f9d170eaa1a8da374d924c4518ebbef035cdea5ad2938aa04829272ae616edd95ef469de53d316

Download Submit
memory/892-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/892-1624-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download