46e8467d434d8ff9cf066bc83aab5cfbe1c10ee1361013bc879f05c1ba1dd048

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0929fa32f27b4c04bea289d7f28391e0N.exe
Size

80KB
MD5

0929fa32f27b4c04bea289d7f28391e0
SHA1

e23d32dd0e56dc2b7c997b7dbbc31bf47049f2d8
SHA256

46e8467d434d8ff9cf066bc83aab5cfbe1c10ee1361013bc879f05c1ba1dd048
SHA512

dc16800a61cde81ac7a330ca6e0f2fca39c13e0bfcb503db3508b026318b2e3a9fae1a3f5df19664ebd70057180fca51656fe081f153e084d9ca5adaab8f7e9c
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZum0mHXxXgOT2IOT2gLj:enaypQSo7ZBXxXgOT2IOT2gLj

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4625) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1776-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233f2-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/1776-876-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	0929fa32f27b4c04bea289d7f28391e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0929fa32f27b4c04bea289d7f28391e0N.exe

C:\Users\Admin\AppData\Local\Temp\0929fa32f27b4c04bea289d7f28391e0N.exe
"C:\Users\Admin\AppData\Local\Temp\0929fa32f27b4c04bea289d7f28391e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
81KB

MD5
d891c836797eebec1ef81146d056912a

SHA1
819c9786e44732be505d2a5a571127f598f7c940

SHA256
35695f26e25b410865f84a6c5e0c955dd6ab6f0bf66b8a4bcda044133d3bed7a

SHA512
414d7b72d0e53ca31868567f728e391d3df6312c918113d3c6d46f6b69fead3c17f8013aef232fb0c7213e3d7348b3e1a455bc2fe7a462d0a31f5867761466d7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
b5633db10ed22c43b58f659054963e1d

SHA1
eae3f047c706b1d0e9fd4b29014369317f5eeac1

SHA256
4fd47c89c6d60cb251929afa591ac04cfab3a3320af8dcd4b8dc5de34b146b00

SHA512
760c4f689532d04e9122ce64214a172682bc6f6ec050c05f550fd0f88c7e245801a792450a2d4bbe7d34f7fab9606f803a5e65cc0957e1d97aadfc8021217dcc

Download Submit
memory/1776-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1776-876-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download