1a27bbba40ba7a159fe57c93bf2383fa429b45f1d8253e6c2b96305a3b07d0b1

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd1cd3e2a11d70f54575adc2c7602860N.exe
Size

80KB
MD5

bd1cd3e2a11d70f54575adc2c7602860
SHA1

3f83d0ec404d3e9b28339772b2133229f4b65fd6
SHA256

1a27bbba40ba7a159fe57c93bf2383fa429b45f1d8253e6c2b96305a3b07d0b1
SHA512

65679aa8be165f06d68479a456b2a55003d4455910a3e50db0c529fc21c9eb0b6c8f093377369dbeb11ec550bb06c31bd0c15c48e0b8210b00a77edc2d12c730
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5l:fnyiQSox5l

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4384-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000234ce-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/4384-812-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\ExportRegister.odt.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	bd1cd3e2a11d70f54575adc2c7602860N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd1cd3e2a11d70f54575adc2c7602860N.exe

C:\Users\Admin\AppData\Local\Temp\bd1cd3e2a11d70f54575adc2c7602860N.exe
"C:\Users\Admin\AppData\Local\Temp\bd1cd3e2a11d70f54575adc2c7602860N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
80KB

MD5
86f0d329f7c11d5cca1a0ff57b83aed0

SHA1
b4aacc945b2791ffbdc8af1777d62537e7487078

SHA256
ffc2b1135e6818fc3ec68b38553dbab7b41336be08ebb91b050ce4cd52fa9f28

SHA512
4b3abde459376722715fce23f307341af1faafde11240eaf46073b2b2ed6a3d90fee93610d87460723ffa9827099e61cd97d557c9789b8182c9db1d02c8a9c7b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
2ca2d69f604b7228125e962d76c49615

SHA1
d537b637c9b37722eca7e7709c99e31a975f2104

SHA256
778a6c8dce4706cf9513f36a68fa4fd220474753f0ec50fc1b704be1cf6444ef

SHA512
d968f97219fcfe39965ec62afd927692f4f35e9a66c35e065e76837b79a1d7f9875135852ad23195792b7f83025f121fb85aec69195465516df87a3aabf4a108

Download Submit
memory/4384-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4384-812-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download