5f9026c275801c1a19633e009a8940cc6ff667a13ccb2725c357266c90b28437

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84ecf03159e665094b40610db1a74a10N.exe
Size

25KB
MD5

84ecf03159e665094b40610db1a74a10
SHA1

2902da62e29029667c16c274340752345900033e
SHA256

5f9026c275801c1a19633e009a8940cc6ff667a13ccb2725c357266c90b28437
SHA512

9de73755ebcdc2d9fde2b1bf48507420debe689fe6166658a908c6e3f3bf806d6d4959b53022b6d6f8a442e4a10355efbc2082fb95fc687996143a14f4f5a8fe
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9mHJGvBJJGvBM:CTW7JJ7TEHJGvBJJGvBM

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4677) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3416-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023411-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/3416-1003-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	84ecf03159e665094b40610db1a74a10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84ecf03159e665094b40610db1a74a10N.exe

C:\Users\Admin\AppData\Local\Temp\84ecf03159e665094b40610db1a74a10N.exe
"C:\Users\Admin\AppData\Local\Temp\84ecf03159e665094b40610db1a74a10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
25KB

MD5
00153a255ae8ede904633102d0415bfb

SHA1
5d4dc8b4aeb96d6ec15a0e4a5d8009ae4f797266

SHA256
3df9992bf470147d19b8c1c4f8ef7f427c01b08e045533f8fcf195daff7e8641

SHA512
182eab1538a7fd4f78a7332473ec16d7e203aeb319d7adabbbd75a35ca6abcb2a48a2d79c6edc8581e3fd396de4e3a3f4ae1821671104bf53bfd8b6c573f36ce

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
124KB

MD5
1a7cdf1cafb88e122c9dd9fd38042d71

SHA1
331c5c4e30965f31ede13ec41e4a98971dac69ef

SHA256
7b35fb9b77dcc1734ebef44983d9e5ad021f3ca3f592a20948fbe89b6b25f261

SHA512
f868c66e9ee1963aea7da5ec04ee9cde0b121730363a146bb3d6a5a8c215d11911cef3ac894635bc952525d41cc5fadf6c188ff41c45039a3a003b2735adff71

Download Submit
memory/3416-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3416-1003-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download