84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
Size

55KB
MD5

560cc9e9a3c20385788b4d93fd0fcbef
SHA1

bef7164ea7b0ceea7d113881f4ceb04353863ca5
SHA256

84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656
SHA512

344164482fe1477c2d934ddfe308f2f5699c0940a5f413f14f4c90b3d4ed62c5bd87572ab7d93eaec89a4be43db126d6faf99b2931aa2a755f5e3a294baf914c
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIT:CTWn1++PJHJXA/OsIZfzc3/Q8IZTR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5028-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023449-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/5028-936-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SignalRClient.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.boot.tree.dat.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe

C:\Users\Admin\AppData\Local\Temp\84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe
"C:\Users\Admin\AppData\Local\Temp\84b52b41af26840816d1ccd474316f3e30f3aab464986ad33777024965ec3656.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
56KB

MD5
452ef724d5be35173d898f6d04c51798

SHA1
6ba26627a00effa3a1e31016511873775d36b217

SHA256
b20a3ba094b75dcd0932a56987e52dd37c02f98f880f18f01ef1b9b986ece4e2

SHA512
e93ce06366e1751722078591b8cb76f1b9848cd38bfec3142d3260eb39d524a0844fa5343f67410b85619bef70a20ccbe76a9a5e399749584013bc209197c2c7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
5df26f6ef0cb68ca5857456040e222c1

SHA1
f5bcd2299eb81fbc0a3d17f06b0c9774866a3161

SHA256
e1fd54e124dc49e9ae29c5342a86b8c133e9a62e228ff033933016db5009cb68

SHA512
edbb6c4fcb9466f75e6d5167393b9fe76058b696e4060a9758bbae937deeff67905e10f666cbaea1a3862ea83f5149003e870d6e5ab9564d31e9a31082af1e63

Download Submit
memory/5028-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5028-936-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download