5dc0c2674b7df8659f964533efad60d02cd360f72f20c5eb32cd94b99205ddc6

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93d610e7e1d76c117133a4d12cca9c40N.exe
Size

65KB
MD5

93d610e7e1d76c117133a4d12cca9c40
SHA1

f7b6af00c34e0c5cca79469a1dac6dfa2c464553
SHA256

5dc0c2674b7df8659f964533efad60d02cd360f72f20c5eb32cd94b99205ddc6
SHA512

1edaff9e04c9414c99cb4f27e88ecfdd15b89a0ea2e1fc3e83ee9d9836f6433ba39e59ad3ee4a0ace46562dab5fb94331b2984a0c2a14907c56d4006b837ce5e
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDr:KQSodYeHNmkDr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4574) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5032-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023564-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/5032-1106-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	93d610e7e1d76c117133a4d12cca9c40N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93d610e7e1d76c117133a4d12cca9c40N.exe

C:\Users\Admin\AppData\Local\Temp\93d610e7e1d76c117133a4d12cca9c40N.exe
"C:\Users\Admin\AppData\Local\Temp\93d610e7e1d76c117133a4d12cca9c40N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3668,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
65KB

MD5
fc5d33ba0129ce4f0f62225222d3247a

SHA1
22080cab0fa02ce041c3f1a9b7d5a5f505773500

SHA256
6587e4830181d73784c1746db69b71fc07ba48b8d99948dd9c90b660d89790e0

SHA512
ec3e820f68486b930aa5beac64dd22dc7c7db36d9a0627325dce80c2cd3325c5686c2cef1b0277063f351628ad4240a8d1da592e1eed519360914d711c3ec8d3

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
177KB

MD5
bc8e945f980592b1307bd42a140215f9

SHA1
03a8a527bf90692d367d9f39501fb8d6277d3d9b

SHA256
55a62fb1e86eafb4d24027b919398127ff0043a552a9ea7bd22e1f652d6cb29c

SHA512
2c4ed2153a87347a37fff09d682c22d390f898071fed07be1aef463e60a37a62f07000858acab39b665411608aa30ce4a1fd5be9ef49953e87dfe7b072c5d337

Download Submit
memory/5032-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5032-1106-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download