d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
Size

33KB
MD5

db30801be1a3f768d6319bd83329f37c
SHA1

a6a43aa1227c018b6c3ae5c851ace893f35687d1
SHA256

d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4
SHA512

b13b0df18d2883ae52f88a263e3abd061d73a7f6ba96a9ced40ab5531f08f386b68e86c3c2f333fd4e9a80719ffa44b1ee41eeba59ef370b231a230dc029f2a3
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mdnTHAlJ5HAlJj:CTW7JJZENTNyl2Sm0mdnb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4960-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002347c-2.dat	upx
behavioral2/files/0x0014000000022930-6.dat	upx
behavioral2/memory/4960-1230-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe

C:\Users\Admin\AppData\Local\Temp\d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe
"C:\Users\Admin\AppData\Local\Temp\d65d9cbc6d064553952b07cff70def53df79af8236d154bd646c62436e9d07a4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2077438316-259605770-1264560426-1000\desktop.ini.tmp

Filesize
33KB

MD5
bd9b56a53a4f2c1ebb46537b20c44dd7

SHA1
0c3ab399b80fd3cf0a73d95bf9f40596dd0efc07

SHA256
037d0c0d08035eb5a0233c218d27ade6653581367a274497674eba55e35e23c2

SHA512
1b64eb9a5873b1d53405ad88768412b87a024bd689d692e6e7539f00d90fc4760c3920c0496d662e3874bf9c9abae279d0f976e5b21c4e2cfd8d64f3b99f8aa3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
132KB

MD5
cc915f0b2c51035d6b081a37ebc2d040

SHA1
3e793fec4c9cb384c038761f837d050fc75abb6f

SHA256
f5f2e4f54002076b75b9a314ee805620f05e70954e7615277e53d9832f80aefe

SHA512
bbfabe6477a549c9be79cab4b86668f0be666de87cd70f10786b24b97efb78e947f89c497cbf149228951e6361376e01a268587a1e75a790a354d07dae4cfa50

Download Submit
memory/4960-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4960-1230-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download