89c1010acd593876e1fc957acef2880d274467e3d7b6d989f5294d94aacf7cb8

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d29807f3ccf071ef3d8310d82984a20N.exe
Size

169KB
MD5

8d29807f3ccf071ef3d8310d82984a20
SHA1

5422598fc0257e640b4d51ed2840949c789d5d70
SHA256

89c1010acd593876e1fc957acef2880d274467e3d7b6d989f5294d94aacf7cb8
SHA512

0d68f8d8538d7c930cf18e1103e722227d0163f17b190268fbc557ed116697526650565fe816b40370b34d2db92eec8e2968b15449c41ddfadb2259f6debe68c
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8zx3Y3hx+fsio5UxKzWZ64+A8C4bwi:enaypQSo6VEio5Ua4N+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1644-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023419-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/1644-764-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	8d29807f3ccf071ef3d8310d82984a20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d29807f3ccf071ef3d8310d82984a20N.exe

C:\Users\Admin\AppData\Local\Temp\8d29807f3ccf071ef3d8310d82984a20N.exe
"C:\Users\Admin\AppData\Local\Temp\8d29807f3ccf071ef3d8310d82984a20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
169KB

MD5
0eff35fd50738e0be1285575d597ff19

SHA1
69295affb7209ee00c8dd5364b0cc77fa7cde180

SHA256
75ba34f265dd57ae1bc58af0910d77ee4cf2b6e5a8100b747de6f154b0d8e9c9

SHA512
7340e4754921f3ff3533793b4b8ad94ce7910df536df319d05184e576bc1caa3466e84a0f4ce2528a769bbd23126c72ac42c5cd5f02b65231c231a48e23eec0e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
268KB

MD5
76e3b706d70e2d6de292dbc5e5c9e074

SHA1
8aef37bc9991a788950a9f74afdf2b9881962854

SHA256
8599c07297ed9b5badf0400bd8dd00156b0180983a5580c6461b3f745eed15a7

SHA512
1d5202de7b1df524e969e2ef17921e3dd42f0d7931085e3cda1d4a1359e47f88217ad8fb6ebcca0ee21ab056a6c45b2c90097b32abccf390a42b1ad48e1b56fd

Download Submit
memory/1644-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1644-764-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download