6716211cb2f2349e33b2843b71ca155a9941c1f57a139b77ae5b8ee0a5c2c8e6

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

641f0c4b44a107b94a91460b50062fe0N.exe
Size

28KB
MD5

641f0c4b44a107b94a91460b50062fe0
SHA1

0a78f5e8058f9e1a266c44db56ec265abafc7b17
SHA256

6716211cb2f2349e33b2843b71ca155a9941c1f57a139b77ae5b8ee0a5c2c8e6
SHA512

f5605c03d52f0725c5cb800d20b92a9d82f9f0bf996d538395f613d5912f94a2278bc4c71b3778eb0afea20acd5658e6cf32c331a9ef5db1f93460f6b08995be
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mk12:CTW7JJZENTNyl2Sm0mD

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4717) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3016-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233f9-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/3016-1236-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\CompareResize.avi.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	641f0c4b44a107b94a91460b50062fe0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	641f0c4b44a107b94a91460b50062fe0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	641f0c4b44a107b94a91460b50062fe0N.exe

C:\Users\Admin\AppData\Local\Temp\641f0c4b44a107b94a91460b50062fe0N.exe
"C:\Users\Admin\AppData\Local\Temp\641f0c4b44a107b94a91460b50062fe0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
29KB

MD5
3f426666de94318cc5fe47b92ff24e4b

SHA1
bb737cde691695871f8451b3ded5b66b3819499b

SHA256
afd55e11050cd0a293f69851d61abd099c11b1807ff94008f70f1e046bb117d5

SHA512
7e1fd69953731f49163914a81fd8845ccc487035680d0a38a2da9c550417cde10d18e67b9a53d06997c3d46be4bc34c1153434ebc5179dc479dfd71b346a1628

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
127KB

MD5
02ab26c017f20d250939a23bf441e712

SHA1
a2fd236c0b73a23eab2b29c7cf97233eee9de52c

SHA256
93c77ed2d87649564634d24ad693be1c0b5ed3a94f38d6a6fc9939606e376e62

SHA512
70513d232c1283b27a29a50e305b5e5229487a13d2c73bb03d5b06f71cd94ffbf23c01177a3208d1cead1cf01f8da343aef72d4fd849d6102161fc11c7b1a796

Download Submit
memory/3016-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3016-1236-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download