29b939765f3aa9c7aa33fc878a94399a3ce65d7f0f1a2c3edbba0af0cd50d6d0

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68fc6f2d056e6ed37a772ab12a69c7d0N.exe
Size

84KB
MD5

68fc6f2d056e6ed37a772ab12a69c7d0
SHA1

466318a4f2836deb4419eaa68e90c72fb30efc20
SHA256

29b939765f3aa9c7aa33fc878a94399a3ce65d7f0f1a2c3edbba0af0cd50d6d0
SHA512

eff2a33fec8a9afc4f945e973f71117dd3384726d28d14b2de0ea308956ccc8900458505ac82d769bbf9f1384e528fee73dca5206c1a3782b181261c60271ed1
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8NCuXYRY5I2Iefz:enaypQSoDuXuv3efz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3268-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347c-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/3268-1906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	68fc6f2d056e6ed37a772ab12a69c7d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68fc6f2d056e6ed37a772ab12a69c7d0N.exe

C:\Users\Admin\AppData\Local\Temp\68fc6f2d056e6ed37a772ab12a69c7d0N.exe
"C:\Users\Admin\AppData\Local\Temp\68fc6f2d056e6ed37a772ab12a69c7d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
84KB

MD5
55db8a3c12da4ee9620ef4d05faab85e

SHA1
00ad34881287aeec13a542109bc6b095f058c70d

SHA256
f84e1d5a44d240c3668f16e40545b7397abb86948e22a9e16fc88b71c85d19da

SHA512
0d19ff312b64129588c527e351da25d685c4d879da32055c4a038d363fecefa576e73c0d2d03e79ee18d0a7df77d5145125fc6d41a51c9330f42ed9db8b17e62

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
5c25903457e74e527d9b835f3ea74d43

SHA1
6acc54885051220f26efb89b0c5cd5981aa53d8e

SHA256
254c564760192a09ac3c5516e6f9eb9e2247d1221b89a591d6b4c6cbc46f00a9

SHA512
9326c0a03263ab12aa3ca5c3a33e413f3416b0e6de68d33fc3b5a3523199737a134a94c452189b1ba45571505e99bf7a7892b82fa554bc9896d93de05a15e461

Download Submit
memory/3268-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3268-1906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download