e5126287a1c716d6952e5caed96327ab47bddb93b9ea9e3bf9d578673768cb81

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbfdb18691ee1ae51b1c0c717910b830N.exe
Size

73KB
MD5

bbfdb18691ee1ae51b1c0c717910b830
SHA1

088861bfc3256a858bd90ad7493ed437271ef9b7
SHA256

e5126287a1c716d6952e5caed96327ab47bddb93b9ea9e3bf9d578673768cb81
SHA512

4bff83fe3a7b3b5fdd875f57bb38ba6f42c15281bfdf46101eedd00040a81e03e2e1ed7f728bde88bcb8149c90170a19d8d3baa817497ec24cc7dc1e3e3fdca2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxxD2Q:fnyiQSoxQ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2035) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/448-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347a-2.dat	upx
behavioral2/files/0x00080000000234d5-6.dat	upx
behavioral2/memory/448-1258-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoDev.png.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sv.pak.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	bbfdb18691ee1ae51b1c0c717910b830N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbfdb18691ee1ae51b1c0c717910b830N.exe

C:\Users\Admin\AppData\Local\Temp\bbfdb18691ee1ae51b1c0c717910b830N.exe
"C:\Users\Admin\AppData\Local\Temp\bbfdb18691ee1ae51b1c0c717910b830N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
73KB

MD5
5bdf980cdd6b56c7b7f84638f86bb04e

SHA1
8cb5197625b2578e5c55425bea5fe47c92311200

SHA256
18271c3dc7c0aa567600ca824a87b29a92b8702791a9aea40fa3c41c0560f1f3

SHA512
509b27d7fe8ac3f54d7da42613882952f6226a35b6f6a25cb04f5bf3255176036985477e4c6f427774d08d963e91405c85c133da665b08ccfa5bae5eaf18bb68

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
4da46daf2b7ec5d6f8a8086608570ab1

SHA1
6a8332250cde0abb02d603b5ca87cc03d62fbaf6

SHA256
3bad02b193f117e2b5b32d04ebd30800d27238f5d52cffeff96df1294bd76534

SHA512
f393dd1ce92583856014d3b08817d38e986a6e9a69ee9545b20ea00bf3fbe77ca846280d9ec3568e7b7d6661f61588fac55d6e69d835de0a688ce4187ed8fa9c

Download Submit
memory/448-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/448-1258-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download