139fad15ec2d260eeb6803f440d6a60c7beda021dd1fff5ba05884e73948ca0e

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

050b32410db52b4869b188bf48e19660N.exe
Size

51KB
MD5

050b32410db52b4869b188bf48e19660
SHA1

b48ea250b4a816ed74f65c38174adc817f51679d
SHA256

139fad15ec2d260eeb6803f440d6a60c7beda021dd1fff5ba05884e73948ca0e
SHA512

dcbaeeb96c275bf6edc20f697ea31af11b6264b9a0a609ad0b4d250fc3d6d24d23bb4b169d2260b840fb6fa32d6b96a4ca090f8b7825ec64a475e45abf6d9141
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBUEXBwzEXBwv:V7Zf/FAxTWoJJZENTBs

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4696-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000234d1-2.dat	upx
behavioral2/files/0x001400000002291a-6.dat	upx
behavioral2/memory/4696-796-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	050b32410db52b4869b188bf48e19660N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	050b32410db52b4869b188bf48e19660N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	050b32410db52b4869b188bf48e19660N.exe

C:\Users\Admin\AppData\Local\Temp\050b32410db52b4869b188bf48e19660N.exe
"C:\Users\Admin\AppData\Local\Temp\050b32410db52b4869b188bf48e19660N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
51KB

MD5
3e21477cbc083bdbb4886ba64f62a48e

SHA1
4f91e7d1d6b8b4673786d1725dd887b5a9fc636e

SHA256
121ab2b72ea47da43e95e9ed2676d72b9b6bd7e4ca0805959887ff9f9c99acbe

SHA512
693c85683627c4ad9afc1846c98b46347083cfd2acf2ed1e2230bb947a7918e3faac2cd971b5d80d4731f333d739e0a59cc9d55886d0f413338c94e23f26e1eb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
89bd2e11d6ca951e536284adf8175d32

SHA1
6933b04dc93802ac97f7a1336005063db39cff3a

SHA256
edb7097253fecbce97ac561b91f7fedeec07569eafc7901c5895224f949d2658

SHA512
aa8fb84982efdbd24316c33c6b37e56b86908a0c70fcdc5d1d447c2718ad3981ce7592f8f333423631b63408de46bae707f626da2f2729e9a51057e65ea10287

Download Submit
memory/4696-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4696-796-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download