936efb6c1d949a7d292e2f624f007357f9a785b0fac3b3cf9cc0ff9e6549950e

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71d13e5a4b99749e4cabeb4590508ba0N.exe
Size

75KB
MD5

71d13e5a4b99749e4cabeb4590508ba0
SHA1

e7cb66a0244d589fc69adb2beb81c3d9c2c64b1e
SHA256

936efb6c1d949a7d292e2f624f007357f9a785b0fac3b3cf9cc0ff9e6549950e
SHA512

21d5a28bda2151b39e782153f532d4247b1186eeb1e1174323444d8cc090d0802eb0208fe1040c2fc8084a48ed4988cac3ff6ce7f6f435dbef2f36e436887eac
SSDEEP

768:a7BlpyqaFAK65eCv+cIA0fm7Nm0CAbLg++PJHJzIWD4adZdhAIuZAIuniXKqAJxi:a7ZyqaFAlsr1++PJHJXFAIuZAIuE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002340e-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/1148-898-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	71d13e5a4b99749e4cabeb4590508ba0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	71d13e5a4b99749e4cabeb4590508ba0N.exe

C:\Users\Admin\AppData\Local\Temp\71d13e5a4b99749e4cabeb4590508ba0N.exe
"C:\Users\Admin\AppData\Local\Temp\71d13e5a4b99749e4cabeb4590508ba0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
75KB

MD5
c1e8f77b450fb97696c4f4a03d3bc955

SHA1
1ddf45dc88bfbdd55bc96f0b3cfa2548c0716d10

SHA256
bfb60a5a8fa077eec2fbd0b08de3c35bc1ea85e3f50392346590129c8907ba90

SHA512
32e671c4d0042066ece127abedddfb63b63a2c72ca2c9deb0be9fbdd879aa6a25257129ff011dfba1eba3b6f37efbfd9bb568fcc53cb10993aed6f02358c356e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
5ece15bb763434fb4062b7205c11e613

SHA1
2d615920fb70aa705ebe3669aea11f867957b07d

SHA256
2744afb4f0e24669ab32a710e6e89a2dd32ea79369dcd02e214d9227b752b90a

SHA512
71ef6dd915675517ea85aabd946d75e91bccb43d5bdeee6bf6f22459da9417366daeb308115bcc505a7ca1aa0d5e895b45b90045ecd73c45671f5359761a97d0

Download Submit
memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1148-898-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download