38b1ac3e9f8db8c0bf5138c676dab8898f21859e45ddfc9353f66f10ba00e6d9

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79d7816c74a3c3e651ac0bd5a8756390N.exe
Size

71KB
MD5

79d7816c74a3c3e651ac0bd5a8756390
SHA1

f8605de38588333619097501c6f659fe2d23c2ca
SHA256

38b1ac3e9f8db8c0bf5138c676dab8898f21859e45ddfc9353f66f10ba00e6d9
SHA512

d3e27e1be552b156b1328723599617c62160787603c0fb7ce1ba3cf67eebfd92b415e55f805ab07069b57a180bf4660f8b237ce21ebc65fc82a40850ff6f10f8
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCIqwq+:enaypQSosk7Nz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4617) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4292-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023424-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/4292-865-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	79d7816c74a3c3e651ac0bd5a8756390N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79d7816c74a3c3e651ac0bd5a8756390N.exe

C:\Users\Admin\AppData\Local\Temp\79d7816c74a3c3e651ac0bd5a8756390N.exe
"C:\Users\Admin\AppData\Local\Temp\79d7816c74a3c3e651ac0bd5a8756390N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
71KB

MD5
1c2217f9a7f1a2e4ddd3820664f958ad

SHA1
d2e5f9d2fb84de7be77b2eac9f1c5342d90c41d8

SHA256
e44012999db9b982b8035eac151035134d6c46e87ac9beafe172ce9d20f40203

SHA512
c98da7c3216140af27b6572edbe5ef689b930242c9e556af75c2f0dd6d0eb39324b030da58fe96f6d6f46136f9fd3e305fcaacc6a5f217efc558b202f28f65d7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
024912ffc2dfec77654cfc60a58e79e1

SHA1
6290ac5b3d600b0ae4538b2fec266d6eeb77e019

SHA256
2c0d20e63dc8e92781bc8dd9055e37d5055e6f2790276c0dfb36f9a85299b777

SHA512
edc4c4ee69c7ff0950a818f0fcf6066cc5e74b143278e4119bcee40d28e8b7508b2a345388215eae1aab817ef10d85b6e56ecd02d1de995a989e1f3f84d667b8

Download Submit
memory/4292-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4292-865-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download