1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
Size

83KB
MD5

4367b48945b5c5176fc7ea4cc52c38fc
SHA1

77f5a19b0fcc8ce5077605d6a595b4c3a158dc24
SHA256

1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9
SHA512

df18cb4abd9277f9d3434dceea876fd16806eb54a3809bc1e317d6b1f5806541bb26cefa6cc0a9c3380a525a3c4b5e6f9008be98b136430ca64eb27fdb0615e3
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxQiKJAWJAC:fnyiQSop

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5043) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002349e-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/1440-1884-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SEQCHK10.DLL.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7fr.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe

C:\Users\Admin\AppData\Local\Temp\1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe
"C:\Users\Admin\AppData\Local\Temp\1b770bcf965ba0580c878b0f6ed03c8e19548cc66fa32d570b906d7e7582b6c9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
83KB

MD5
96472331a5699b03180c72d3a18fbb43

SHA1
a954e412b4c0a6f8fb9b3ebe550c2b1ff999ed45

SHA256
7a40a913524aa693471b6f437a55112db674cd78edb043fa0fe00f9f6be75ff7

SHA512
767d358a4f1f01e1b3815cf0afa7631b99459a1d5f41fc7bd7dca09241b23b6dc2b495c0b90b6efce9040f05c232148a2129d8ceb57524f2ab750553d638cf9a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
182KB

MD5
86207e3d0e7736cc52714002f83e5fc2

SHA1
225194918a3199b97218fe549004f60eb23761bd

SHA256
da5c1cc282a0527d963fe4b76bb8ecd38e0096c6acfd34c27bb5e199ba2e6018

SHA512
92d360f42fe3c944ab111455ff65ecf363f18f543a1477a08a2e55eb7f853f0887ec7640b5c395c15c5d5ce680c07ed442d42dbd6c60ae66793f59889a31c99b

Download Submit
memory/1440-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1440-1884-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download