797fcde04b7727c458c2b051449b8c1583385d113e3d05de3d06af1c3c98a9cb

General

Target

98b59a3f11b44be0564784f665cd1280N.exe
Size

127KB
MD5

98b59a3f11b44be0564784f665cd1280
SHA1

a9ae94ac38e8796ecc1925a302007544cd7f4832
SHA256

797fcde04b7727c458c2b051449b8c1583385d113e3d05de3d06af1c3c98a9cb
SHA512

c725a4a83562ad24e0f9b6dded9ca816a7aecdfdeee6f60fce1d6166ea517122281e7c8750c1ae0c82dc4e934579bcf3fdefa7a73b7c11b878488ec33a4bbffe
SSDEEP

1536:V7Zf/FAxTWoJJXV6C6tfeMW1iMzArE/TidjhyKieiO:fny1bstfeMQiMzArE7idjhyKieiO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1961) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1156-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1156-1362-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

98b59a3f11b44be0564784f665cd1280N.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\es.pak.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\vk_swiftshader.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\mojo_core.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\libGLESv2.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\hr.pak.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\debug.log.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\resources.pak.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	98b59a3f11b44be0564784f665cd1280N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	98b59a3f11b44be0564784f665cd1280N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

98b59a3f11b44be0564784f665cd1280N.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98b59a3f11b44be0564784f665cd1280N.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	98b59a3f11b44be0564784f665cd1280N.exe

C:\Users\Admin\AppData\Local\Temp\98b59a3f11b44be0564784f665cd1280N.exe
"C:\Users\Admin\AppData\Local\Temp\98b59a3f11b44be0564784f665cd1280N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
127KB

MD5
9dc1d17f99d35c14c687c0c1d7b6ca30

SHA1
64a81e309e8a3005aa2b2611de98dbe8755f5e67

SHA256
96e74be988a360d49db718c9f42c44671b81e9e1fae5e7bf51b7124cafb13069

SHA512
16fa95e86b2a71f74041c7460e1b287e0002458e0f1fddf211c4332c5d1b68218a628765f223334e0dc53eee6e4ecabb40e3d6655c67added4ad6660d4cc7ff1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
226KB

MD5
362efb5af94b3d35b5146bb2733845b3

SHA1
471ef19b013b65df80707fe512e0b22db3007a01

SHA256
3dbcd04ce0394f00777500407ca7d61986a9462563df91c115f441ba08da77fe

SHA512
3c65ab38305d594730ff9d0fce0535cc1015a12e4597c1e64e39656c1027fc9b67fa24c32a3b5f278f97634453e15e03dc7bf4d21592a6c22f203be7d73e060a

Download Submit
memory/1156-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1156-1362-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing