db61ddf79393e06191efe3d4893c97d9e0f2c92632f2fe50ad7667ca9e7d65d7

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4b72c7668dea16db6a9278be168acfa0N.exe
Size

19KB
MD5

4b72c7668dea16db6a9278be168acfa0
SHA1

483c5d2636a74925a74dfd6f74cb1816b85ac9e5
SHA256

db61ddf79393e06191efe3d4893c97d9e0f2c92632f2fe50ad7667ca9e7d65d7
SHA512

8fd46dd1d3f931505673b5b2a826ba48bee9e3249d122b5158902da3a30161e39ab0851f1f243860da430cbfb7ad1c86714d12d1e8793e4e621ca3d96559c815
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJcv9c34UD+34UDnVun:kBT37CPKKdJJcu34N34mVun

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233eb-2.dat	upx
behavioral2/files/0x000800000002343c-6.dat	upx
behavioral2/memory/4480-866-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\de.pak.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	4b72c7668dea16db6a9278be168acfa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	4b72c7668dea16db6a9278be168acfa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4b72c7668dea16db6a9278be168acfa0N.exe

C:\Users\Admin\AppData\Local\Temp\4b72c7668dea16db6a9278be168acfa0N.exe
"C:\Users\Admin\AppData\Local\Temp\4b72c7668dea16db6a9278be168acfa0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
20KB

MD5
4b44631bd99ca0d9fc324dd29d014657

SHA1
25c4464f3443701922a37fbec872b2172e23be6d

SHA256
a6df211d6bb319e918ec33c21e46fb00614de6fd867ad36c2d4f26488c5d21f1

SHA512
6a4cb6f8f8222a5c61d015488cde5755f5363e6e8919f4df6d83b081afe64a44f38df82493d77b56a25c596553a50b70c9fc29aa5b454782b3cd4fd500f57af5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
118KB

MD5
09333ad0fe0580acea3a4bc76229f690

SHA1
e2867d9bf024983153f5388b5cb71d113be307af

SHA256
5415bccf1d0a74b17d62df045eda132326f3390c3602aece9a4addd851fe9d74

SHA512
d3afbebf718620256299bd3d1f1a60237151ebcf49c7e49f96ac8fe0e3b35e1517471bcb9bf13d0fd738dc779c1b4defc9bb9822c643f3fe38e970ec08c0d60b

Download Submit
memory/4480-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4480-866-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download