9364faffe801d9bf6cac6d3ce3baf0e7f7d2d175aaa2deba9c68061c9bb2046d

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

83e84fd474a199a3b76c465398c0d100N.exe
Size

75KB
MD5

83e84fd474a199a3b76c465398c0d100
SHA1

6cdb719d205bc62998d27d33704d506675c1a7ec
SHA256

9364faffe801d9bf6cac6d3ce3baf0e7f7d2d175aaa2deba9c68061c9bb2046d
SHA512

5f27967b95850cc93e1db7181f7dcde7ca537780630f570ff3622554e99fd9721209a66475e1eddbff63d54d4a1a4cf4067d7ff53acc4fbc358dcedc78c1f431
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9+BT37CPKKdJJ1EXBwzEV:V7Zf/FAxTWoJJ7TSTW7JJ7To

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1448-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023489-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/1448-860-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\CheckpointConfirm.vssm.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoBeta.png.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	83e84fd474a199a3b76c465398c0d100N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83e84fd474a199a3b76c465398c0d100N.exe

C:\Users\Admin\AppData\Local\Temp\83e84fd474a199a3b76c465398c0d100N.exe
"C:\Users\Admin\AppData\Local\Temp\83e84fd474a199a3b76c465398c0d100N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
75KB

MD5
d37d8bbc23140e846a1f1de210ad49e6

SHA1
8ba86becea46f20629aa3b33ab75feec80b764d1

SHA256
8616465286de305e2a18f1ae0a0c4b65e17c6b0deeb543cbbcb62f8a6e764cd4

SHA512
be53cc0d5202a50a43959385c76270f4721f9547d455bb3bebc2e570ae9571e03d3654e28c699e871ae7eaaa173d243a6caa48dad79d16cb3a2de63a26e3beec

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
b30771995727c23643053b8f1f604c36

SHA1
5f68e5be9bb8c98109d664951a9c0510ce495bef

SHA256
7f60d1d17c901db8feb234f383f7b797902fe8ccc867f34600f723940d57740d

SHA512
175c13237b8038d7d08794d6c827e77b3a458a6a6f52201ae8d06601987c7b2f12cea89ab3b93a5f6cec5be74e2916b3cfa7736d74603339a05af81dc19ecff7

Download Submit
memory/1448-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1448-860-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download