7f22d2be151b3fbae51b1e0bb569bbc85505daf241c0c2b9df9db7da5e1618f8

General

Target

7bd7d11e6c951094c85962d2415ebea0N.exe
Size

27KB
MD5

7bd7d11e6c951094c85962d2415ebea0
SHA1

08dcca511267ddbe0ad72dac8a9fa23b5cc83d03
SHA256

7f22d2be151b3fbae51b1e0bb569bbc85505daf241c0c2b9df9db7da5e1618f8
SHA512

e305322872344c61660007ed7a35e0096177d0b7d863b751111f07aa2cc4b5bec9fdf5b5fae361aa82e3612ad93163eaa6cf87c7de93dddaff6ab264372a1b92
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lAwJmdSmd5:kBT37CPKKdJJTU3U2lY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1754) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3712-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3712-292-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

7bd7d11e6c951094c85962d2415ebea0N.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	7bd7d11e6c951094c85962d2415ebea0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

7bd7d11e6c951094c85962d2415ebea0N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bd7d11e6c951094c85962d2415ebea0N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7bd7d11e6c951094c85962d2415ebea0N.exe

C:\Users\Admin\AppData\Local\Temp\7bd7d11e6c951094c85962d2415ebea0N.exe
"C:\Users\Admin\AppData\Local\Temp\7bd7d11e6c951094c85962d2415ebea0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
27KB

MD5
79fd603aefadf6dfb58c66e4694024a3

SHA1
790e598adc6f60711bdbcb2857d4a3bc86fd9d53

SHA256
627cdda632de6538206695d13f1090fb88fdf2e831708bef176f283cbcf2bd16

SHA512
3622be825c86c83e33cf32ca08536bb77fed651d27e9d3c3047397a55d9cff63e9cf7d67df5c2c6d500c0c9bcdd39be00d898d47c0db291d1c4a88be7b74359a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
126KB

MD5
446fdb768981adb7c7561e6914ac5478

SHA1
3f348e8f62cce85b1cc7c5fc1c19f67303ad329f

SHA256
5e46a8b8e9ec5e0dce1e18691ef466cfa9a99bf6530e3af760d5e6316c458599

SHA512
3f735d70d1b0776fe84913d0b9263490701565692cb42d89bbca0a5345f86bffad31a7f6a34c4c9bd69768f7752c69b966ee55e03d8e9399b1eadd599fa82399

Download Submit
memory/3712-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3712-292-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing