d809a71dff6798b87c74f3bd472e13305dc7172ed61bf9e182383c43b08da393

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9242b7b74c5ab9286127defe290ab60N.exe
Size

81KB
MD5

a9242b7b74c5ab9286127defe290ab60
SHA1

814b48e9a92a0ee02bc6a78caef2342f6e0e7762
SHA256

d809a71dff6798b87c74f3bd472e13305dc7172ed61bf9e182383c43b08da393
SHA512

f66002f31edf9ae465d6e3e456d87496d181d6492144279971c247c0a9f89ef9e0b3eb5d178966e40009b26d8cf1c7916952d43012d0ad570b135f15f7eb8d7f
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2IhQkQ6:fnyiQSoDuXuv3H

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4618) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2512-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233c5-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/2512-1892-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	a9242b7b74c5ab9286127defe290ab60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9242b7b74c5ab9286127defe290ab60N.exe

C:\Users\Admin\AppData\Local\Temp\a9242b7b74c5ab9286127defe290ab60N.exe
"C:\Users\Admin\AppData\Local\Temp\a9242b7b74c5ab9286127defe290ab60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
82KB

MD5
0a252bf012035e650a8a87770d54255e

SHA1
6cc990e3535db3eeb58103b9691319646a9675e4

SHA256
d8bf5c5b1908d7f6305afabcbb91c2afd78f261e409bf4e5753a098430818180

SHA512
29aef666d1298be411b4e4ce0eb1f2ab763bb7341466ea11a2780d2389e11252459124e5eed9b9708dd8a49bd3ebfbf31dbd6130d2d84888ca78c3d07335e741

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
1f7f26902b7ced064fabf5f2943b2906

SHA1
60aa8bb5099751a84d282abd4b6608be244d62f7

SHA256
71e8eebe3f8c661eb40748f39c3fcb073727a9e1f543b514a5c7bd5f18ff1bfc

SHA512
aea1810fa4dd9b1f626a5bca08f6e265cc589e463e6b35fa63011bfab8061952b0c0c4463d17e6a2e015bd0fbcfb103e8491f9a230cedd337a29c69fe168ac22

Download Submit
memory/2512-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2512-1892-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download