1a148e926f2a7b24a8ff114e444417f2906096acb91b5b45f742beaff6c60d1a

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6fde8dcbd7df787c9318a80bfb3c560N.exe
Size

67KB
MD5

d6fde8dcbd7df787c9318a80bfb3c560
SHA1

e3a8283f148c2618ac2bd7a72abf54d3708cf646
SHA256

1a148e926f2a7b24a8ff114e444417f2906096acb91b5b45f742beaff6c60d1a
SHA512

f3c00f01a1bbd7f997f43c1557e3c238633c2976dec071d8a684ce1c63d357fbe878005202e19ab8a37fe573a3428040c50c32550475c438d751471e88929b0f
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZf2Xcqve5e:KQSo7Zf2Xn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1880-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023456-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/1880-1096-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	d6fde8dcbd7df787c9318a80bfb3c560N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6fde8dcbd7df787c9318a80bfb3c560N.exe

C:\Users\Admin\AppData\Local\Temp\d6fde8dcbd7df787c9318a80bfb3c560N.exe
"C:\Users\Admin\AppData\Local\Temp\d6fde8dcbd7df787c9318a80bfb3c560N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
67KB

MD5
41dd33328f1a2f3786e74fde98086826

SHA1
ba35ef10552108d7e535ecd0b2ec36bbce9bfa81

SHA256
ba079493e5e3f46b8cefe14ef4c6fa762408a8588313d720b06ed4b1d23057f9

SHA512
bded04059eb6e5e5786bd1402ca759580605dcbba10f614d50519ee978d67969a82056e77ef631463c6fa91e6db1fe7942faba2ab2fd1cc6314af4383dff01ac

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
c4dc434de54c05a22436ab29877595e0

SHA1
8278b55fe2ec5603abf2e9f5a1b629db0f3456a4

SHA256
efdb8d379ba71ef85ef1e183ea0fdefae8ab6103d7e494bc433fae55cd77b911

SHA512
4fabca2f33aa54cb6cdcea7cd9044f7da7ee780239fb0d2f74ed66b2d50b75bc8eb7aefc89a9d4631e0c6fb78bf17e2c1c6ad8b983c9c7af80b632021cc74736

Download Submit
memory/1880-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1880-1096-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download