2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
Size

48KB
MD5

2100b66d879d3d58b13dd3ae37d5dde3
SHA1

c2c1836a851c02768ca40a9592e424c8fec5ca01
SHA256

2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc
SHA512

7d7d0465e7429001629be25f28394af80ee285d466a9a82bbeb15ba7f85da4516dddafc28c9b8ca936dc4a8255181657bd2ce99822afa4b365eed9e593eccc25
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFWo:CTWn1++PJHJXA/OsIZfzc3/Q8p

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2552) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000234b2-2.dat	upx
behavioral2/files/0x0014000000022912-7.dat	upx
behavioral2/memory/2520-292-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ur.pak.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\vk_swiftshader_icd.json.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe

C:\Users\Admin\AppData\Local\Temp\2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe
"C:\Users\Admin\AppData\Local\Temp\2851f8fe8db87a7a63e535162fb740fd61f2410a9694ca78ece2e9359a7cd2dc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
49KB

MD5
fd18b9cd9c2db131944abea9910abdae

SHA1
b270b4d5ff52b852eeeb1a62adecd2c41812fee4

SHA256
10fc03329ddd864ce03330a5624c87b909002f48f464e547794e08045bfe90c8

SHA512
0b79532dcab01069dfadf7de05ac66fb4cc389adb95d182c2d12f777c96607a0d332068e8a43769cb7fb04032aa0d1f0afb26554e560fe0284923703bb78322f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
147KB

MD5
fe06ac5745f55c92b0b9bb0302608a0f

SHA1
42f0eb0d96fc3ef888f652876d5e7215908ba8ea

SHA256
96b3a06c3461b1ac116847e6506e483572c3018a3291aae067a790b89ce65656

SHA512
601b33118c7c19bae51cebf80a0959ff49e6f53d019993af3389dfacbc0ab111ac2cfcd29776fa444fec286bece8fdb99e927444ce75891f4f8741618e9b495c

Download Submit
memory/2520-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2520-292-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download