cf6ad1811b15ede582b664afd95d2f1360b5d83d61736433ce7ab9266f2531ec

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d95004ef8e1814a196e836e993f24a20N.exe
Size

136KB
MD5

d95004ef8e1814a196e836e993f24a20
SHA1

2a1fc0213866c69021eb528fc80ee923c0b2da58
SHA256

cf6ad1811b15ede582b664afd95d2f1360b5d83d61736433ce7ab9266f2531ec
SHA512

4d60d28287d8c5677bc59651ce3391e1dd20b2ce04d933f29ade84e7491f5885876fa09ccd3d84d3650e786313168c8e1c72f5e70ef62befa88eaca264e2d52b
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5CTWn1++PJHJXA/OsIZfzc3/Q8zxz:fnyiQSox5KQSox5a

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4472-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023458-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/4472-806-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART5.BDR.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\da.pak.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	d95004ef8e1814a196e836e993f24a20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	d95004ef8e1814a196e836e993f24a20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d95004ef8e1814a196e836e993f24a20N.exe

C:\Users\Admin\AppData\Local\Temp\d95004ef8e1814a196e836e993f24a20N.exe
"C:\Users\Admin\AppData\Local\Temp\d95004ef8e1814a196e836e993f24a20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
136KB

MD5
88b0d4c2cc6e948c2457d43cba3a6d48

SHA1
21c04c0198d95997ea89ea6c43599519848756b4

SHA256
166c97e2a5fb81f9bc269741876afef08925df4363263b4c99f2064c33127095

SHA512
53b48406ae12e8e38780df9633c53cf2efa1cddd1448b7a02b79039acc91ce2738e7969e656fd2c64ed17d6cd6c69ee3b8a585c50cb2e94a5d4bc83e6569be24

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
235KB

MD5
2a942716fa19e1cd38e80a97a4e44755

SHA1
c150b1043fcc94f910c20e16a8b827fa32bc6e98

SHA256
7f08292d7b8da52079f0f92657636695ed53de5a145270900c5d919450f08036

SHA512
82e46d0ace3fa147a502f0b826537cd443d6395d0afb81e2310f8bf2610e67a8ed8c8b29f08fe65381b1aaf16405f573f4bd2d91326e766d16ae284851eef962

Download Submit
memory/4472-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4472-806-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download