b64c8435245a05645a9ea7dc8a781fb679edd907a5ce39a4fa62d658b3369a9b

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

714e1dd12f3818f1af8cc5f35b35aa90N.exe
Size

45KB
MD5

714e1dd12f3818f1af8cc5f35b35aa90
SHA1

daed3b188dc2d46d4ae740e9483f85859d5dbb32
SHA256

b64c8435245a05645a9ea7dc8a781fb679edd907a5ce39a4fa62d658b3369a9b
SHA512

25bfc693f1d5e72ec3a97d5a501c1d14a75428f417f902a43dc0f0da6fe95fa06bc47f26380a1219f8733558bd08f7ec2db99097675594c1f0fe4fb396d9fb43
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy934Ubb34Ubs:V7Zf/FAxTWoJJZENTNy9osboss

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002345e-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/4980-2025-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	714e1dd12f3818f1af8cc5f35b35aa90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	714e1dd12f3818f1af8cc5f35b35aa90N.exe

C:\Users\Admin\AppData\Local\Temp\714e1dd12f3818f1af8cc5f35b35aa90N.exe
"C:\Users\Admin\AppData\Local\Temp\714e1dd12f3818f1af8cc5f35b35aa90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
46KB

MD5
c6811c7cedd557c635a84ee497789292

SHA1
879213d0f80926a466b0c8d171156498e3712772

SHA256
775950b7021ecc4ee01ec8f64c9e2f213d5437e7daea675c23f305fb505ab785

SHA512
a58ade5b02a39e263d358bd4bbc53406183a5b044ce694243ef231ece3d6e115f2221b2881bb3f12b0750b0f89c137dcc1e10a07b1c39db5f45c8f2df15d99df

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
fe085643ca680b75ea1cd873242f9249

SHA1
cd93641eac456c9fb81eea62249142b45c112d9c

SHA256
3fcba6dd746ebb30edbf6b28345cc1f5c8cbd2cd9548d26a46d3d370883d1a8f

SHA512
3645175d1c4477d3331359f62f679490cefecc0bde7a04efdeae669cfc3626b418bead147bb798803750ce173f64235af89be7129a62ebbba3551cd85a654901

Download Submit
memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4980-2025-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download