350bd29e6ebf641f28a45db4da08c68c7ac2d3a6793cc42d77260624f3d3e083

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6a668030bec35a252d5b803d5697be0N.exe
Size

95KB
MD5

d6a668030bec35a252d5b803d5697be0
SHA1

8b6627d9a2da9cc6454ef3230e1f271171315a15
SHA256

350bd29e6ebf641f28a45db4da08c68c7ac2d3a6793cc42d77260624f3d3e083
SHA512

ddf040a0dda20b51b366ad2199a5327a4cc1fca8e5dcdaff5fdc22a9adcbd039d18dc015f931c33b77dabc1c52beda842aaac962bae47f8722fec37fe4157317
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8dE0WnL/Tn5+P+EBIEBT:fnyiQSop8i8dJQbTn5+F

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4558) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3648-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233e0-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/3648-1796-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\readme.txt.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	d6a668030bec35a252d5b803d5697be0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6a668030bec35a252d5b803d5697be0N.exe

C:\Users\Admin\AppData\Local\Temp\d6a668030bec35a252d5b803d5697be0N.exe
"C:\Users\Admin\AppData\Local\Temp\d6a668030bec35a252d5b803d5697be0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
95KB

MD5
753547dfdc418a12ff9ea41984b1083d

SHA1
bb6a73e3c5dadb956b8972513faaf7906f2e4446

SHA256
e6d4ac2a049ed89a19dfda84c28ca7addd5cd91b654a05b6493c4da10d245088

SHA512
37401139cde79752d091bb2976cc324ad06487ff2f84ead4161f53763a87f54d3a29e49e4db2499c80dd26a2d459cd6e255ca6fc782a1111feb31460f7422e6a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
89e486bbf8dd1f0ee5aaa6a90fe8ad80

SHA1
d470b897a45bb127fadec6094bd6f995ffe3d352

SHA256
b810c72d5fe5675b3cd0357194b78e740573240746d80f8d04622a058a58f18b

SHA512
07e9d3125bf603b3a83c9543925e368c027bb131c83b8927d25dd95b614cda611eebd7ef279ad54bf992f2cc487a87e90c1c6b3dd1953e53668caea1352b93d7

Download Submit
memory/3648-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3648-1796-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download