13b284cf708a8a22c2ef5c83f1a36c0813ebf5acb5092eca26f7ee964c73afd4

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

471243e842a18d0a5472271e3d7b3870N.exe
Size

73KB
MD5

471243e842a18d0a5472271e3d7b3870
SHA1

f2cd7f67e717816f458f482f8385c904522c6d6c
SHA256

13b284cf708a8a22c2ef5c83f1a36c0813ebf5acb5092eca26f7ee964c73afd4
SHA512

cf8c75d68451192595627a77d5e5576abf62da4fbbb44ba20f6ccea9e3258af2b8e2cccf7824c47f09fbd1905808302a79b5be3e22c8720e906c512b8bc9667e
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxSJ4e3sJ4e36:fnyiQSoZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3256-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023475-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/3256-1714-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoCanary.png.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	471243e842a18d0a5472271e3d7b3870N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	471243e842a18d0a5472271e3d7b3870N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	471243e842a18d0a5472271e3d7b3870N.exe

C:\Users\Admin\AppData\Local\Temp\471243e842a18d0a5472271e3d7b3870N.exe
"C:\Users\Admin\AppData\Local\Temp\471243e842a18d0a5472271e3d7b3870N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
73KB

MD5
27df1d506bf8cae853aa926b903fce5e

SHA1
624ac05d47c0518a59023c6d0ae8ab62c650f2be

SHA256
93fee439ebb80433973e73c7836baba0e759ed5e0407cb42285c9a82e4d84e3b

SHA512
6078b3531250f7fbe71ef9d5bbc1cdced379386352b7ac2f900246f0bdaa47522948461feeba3f921021917655ec00cc033bc4d8eb1408a620d7799708e8e129

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
d68525faac852f13739eece6713f7cdf

SHA1
1f843654cb923e59f8f25763c06e76630e6ed0ef

SHA256
83c93ece5d47c869ed6544dfd09f7898a55fea89f45b7f2766ce7e229e714572

SHA512
3c8a762ef20ba3bb629e0d7462f64ee070b20775d060d408a02fbeadbb51c458daf48af020fa0a8780bc55793d62ded117351c24cdb652d4e5a952b0327a4d21

Download Submit
memory/3256-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3256-1714-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download