2731ce9934887b25d3c419326853d3f484f317f9754788ada1a64f6b57264abc

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

431372d467707b5662381939766eb9e0N.exe
Size

52KB
MD5

431372d467707b5662381939766eb9e0
SHA1

b034bf36be60cb92211f07e3cabaa93170895d1c
SHA256

2731ce9934887b25d3c419326853d3f484f317f9754788ada1a64f6b57264abc
SHA512

f3ef3731131534fff3616326cfbf43d2cbc2438eff25be7cbc58a45838993b88fe177364ae5c09b1869cf0e82dcc7c7cef756de9981ec1ab19e5207ab56ab5a2
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzA:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5z

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3944-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002345a-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/3944-1108-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	431372d467707b5662381939766eb9e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	431372d467707b5662381939766eb9e0N.exe

C:\Users\Admin\AppData\Local\Temp\431372d467707b5662381939766eb9e0N.exe
"C:\Users\Admin\AppData\Local\Temp\431372d467707b5662381939766eb9e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
53KB

MD5
9e12e626451278e895639cd33e952195

SHA1
6ab1b29ec5dca16e53eb442aa1bbd825cee6c4c6

SHA256
2e56ae17550ece022bb3820742cef7f6597bb25dc1961c11ea82668518e0487e

SHA512
dfb0acc64fdb2fea5febd2a7356b333fdc1cf0c2131dd9e0a3def5da8e956b4a6c9ed7d4d6f6e15e29cdfe620212a788ed29605ad8da814172fd9249f5a65ffc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
b331250dd8ce35acb872bff9ce743886

SHA1
75dd582ae84e5a047af079ed96d75b698bb69c2b

SHA256
f005193be7e41c5a3f1877caffeddb8d2b42ed800547a6191b5154f43bd386dd

SHA512
503a519c61156e9d355fbbd699b484d62ecfaa69c4170f080aa363f027afb251f44d93e1e923149dbcdf631b29a4a49a7ffbb7baf33952dac41de9b6910a692a

Download Submit
memory/3944-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3944-1108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download