f93383a1164448e54550a5eb3e5a63a8a1de3076aaa4bec36c77ba85edd5226d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cdf8db85a4a20fab05e018f860ef160N.exe
Size

52KB
MD5

6cdf8db85a4a20fab05e018f860ef160
SHA1

16b30a8eeb800e2922d306a438ea1b11cfa2e3e4
SHA256

f93383a1164448e54550a5eb3e5a63a8a1de3076aaa4bec36c77ba85edd5226d
SHA512

8aa1c9536c2df4c6237c8282fecb344aae7f6693a88784c4fa5e01bab1ca31e6e0c1ab99e996cfd588f0acb43de2086e8f48e49a5b7a2cbe5850151b828c67b2
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzC:CTWn1++PJHJXA/OsIZfzc3/Q8zxgWK

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/116-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000234b2-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/116-1007-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ja.pak.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	6cdf8db85a4a20fab05e018f860ef160N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6cdf8db85a4a20fab05e018f860ef160N.exe

C:\Users\Admin\AppData\Local\Temp\6cdf8db85a4a20fab05e018f860ef160N.exe
"C:\Users\Admin\AppData\Local\Temp\6cdf8db85a4a20fab05e018f860ef160N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
53KB

MD5
5b217548a4efc6a0207f8c057b412510

SHA1
fa1ad08a46dc8e2251ee1838de61062a0cade06a

SHA256
5dcc623028cfaeec8e364258be0549555d520e051993ab926d55dceca97356b2

SHA512
7bac50414a806b73c1fdf5b4a22a4e9a60f36526a378a88fc9abc9ac92c50a42da94c855c8e123399049f3ead2d2d6158648df1f10eb7f24a34a282d1aa37b54

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
5bbbdddc8dab4e206f3644af62fe9e80

SHA1
fe3aacbc7326ae89a99309332f3e006b96700926

SHA256
461029196837559de686c8a421dd42dafe556ed9c29ec35107c4314e96b64a33

SHA512
1ac7a69e82fd24d70ad9d330b69cce1f275c97bba215475c667448f95dc2e4ec246e22ba06ac5bb8c1fd06979fe6123fc189116bf557edaaeeef292bd0eb04e7

Download Submit
memory/116-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/116-1007-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download