712aed018c59ac7b053b6dd4c81600ad4bf743f193020c03d59a434d75109cc9

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91df8df4b130d9416c8538de8d14cd20N.exe
Size

831KB
MD5

91df8df4b130d9416c8538de8d14cd20
SHA1

025de8329f365f74820097cbc20bf616bd21ab00
SHA256

712aed018c59ac7b053b6dd4c81600ad4bf743f193020c03d59a434d75109cc9
SHA512

d2021c162f9511228896ec552658ffca9ef7fb7c2a044a45297ff3fee01901f562b93ed1289175bdb910e2a5a1234c356c0e3b7246b8c50bddc4ac7f062e467f
SSDEEP

24576:3hV56pKEBhC8iVXrWgqAipHsceoiBX3X+W+s:RV5UPmZrAHfiBHX+WZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2106) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3828-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023489-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/3828-422-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	91df8df4b130d9416c8538de8d14cd20N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91df8df4b130d9416c8538de8d14cd20N.exe

C:\Users\Admin\AppData\Local\Temp\91df8df4b130d9416c8538de8d14cd20N.exe
"C:\Users\Admin\AppData\Local\Temp\91df8df4b130d9416c8538de8d14cd20N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
831KB

MD5
484c0ebb1ec315f03ad951718d0c3e1c

SHA1
8412fceeef47fd6ae00c98c9f240a1eeb1cab487

SHA256
eba72b24ac17bbd5f70a9f2bb24c9e1864755fedddfa247dcd32c40a8e8c62d3

SHA512
92072d297bf7d35dce6503312e2da6c427584790e3359696bc9b847fa3b72c6a3bb61936c52e55c8046dd72f6a83a88a16831559284a3dc1f787598b6afa2f05

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
930KB

MD5
5399b3cbf7bff1bbe308d54e971a6c82

SHA1
a507cd14b45a82edb0ed76bc62ca9cda064bc37c

SHA256
e9e34b49a77ec7b17bffca345902a9156e61749d76f7bb938f8f3265e68ca50a

SHA512
bc51c1a6e9b2bb72a0296cbb04fe960488b4d5ac900729b5e38c3b31782e3f31c673f7628a70da2275ab277baa1de46d0f7f66fea6570e49009efac3570f0426

Download Submit
memory/3828-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3828-422-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download