90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad

Analysis

max time kernel
150s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 23:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
Size

81KB
MD5

53afb7623ca765b65286bb44ae47bbd7
SHA1

108c2348212319b92c5b0a43b49730393e368d5f
SHA256

90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad
SHA512

493c5ea426646190d6dace4c38b590a74ea8351aa121bbf68cf901aaf55a3841fdffd9dcb7761af1d7dce7058872ce4a9397a84ea8ca41a6f10c5a5b80bd9fba
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxQiS:fnyiQSo9

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4876) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1044-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233ad-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/1044-1868-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe

C:\Users\Admin\AppData\Local\Temp\90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe
"C:\Users\Admin\AppData\Local\Temp\90a77857d3fb5cfae4b37cc13843fed938dbe0114840fd60743b60940ab6f1ad.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
81KB

MD5
2935cf3ba5d49eaf61246d9c4595abbb

SHA1
b1131da2ccc08e1762bd1d39e793245423a0807a

SHA256
69515a8affe1a6ae390dd9d2e623644367c90205b6fe171246bfb959e6e5c51b

SHA512
bb40d55d8a45b3102c988c88cbf0558fb0b2c6743d45b9540b05d520af4e71b9405016e46c7d9c6794d0ec5bd42f9688b129c58e2455751d585ea94efc372741

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
c38ca2caa8571914490b666b57e33d4f

SHA1
e5f823c3e04566cf237c23c7503ef7c6cb430e2a

SHA256
cc7f92aeb81078a67c29a7d499ac593904184011b3dcc038f02aedd5ee8384f0

SHA512
734b952b2bb30a830faaf414ab85292a3c0a2cb30fa6d5167ae14d9c22b2e4ada90a7a60b8230a86b5f43d75d09b64a558403c210eb44a3e42106310b2203ba7

Download Submit
memory/1044-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1044-1868-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download