1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662

Analysis

max time kernel
31s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 19:57

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
Size

87KB
MD5

b263c48ccf9e48032c92a0178e08dfe9
SHA1

1bc0ec7c92b23472e509538fe0800494b8385c46
SHA256

1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662
SHA512

2d835652931e2abf4ab4dd1047cf9633ecba3c42a2a8f48ec97fae7bb1173632831635b66c617e63d8c38bb89ba6a11b244f00cf212b130f715bc421a3772207
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rF:V7Zf/FAxTWoFTWpJY6IY6Q

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (913) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023455-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2424-852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe

C:\Users\Admin\AppData\Local\Temp\1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe
"C:\Users\Admin\AppData\Local\Temp\1ac51f9472c8c04d81885c5f312eaa1fc4bc0693e65caa3bb6ba1a32a68b1662.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
87KB

MD5
ff22589924cbec540d7b1a29366c028b

SHA1
741524ddcc95c3783f91b1739b8d8183f14a8a76

SHA256
9ce4cc6af4920db70de1424de2f71ac5228f8811dd2ced2cadc9a0ae6f374b99

SHA512
cae6d30c099bfd3190431d7059feb9e1ce13cd8afbca7049e1317bcb109040d14d7d70d1942f6a97c2b1cb219867a5196a3e7277e96068fc4edfab8ba42be5e7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
b8083cae4ae614f478605b55040ea2cc

SHA1
46f1557b7a91843fd2fa78b92547bdef08ba4fa6

SHA256
bf4455c1fb600a5be4c67919a12da266c3f91c37e17e1357e4ef875d0629895d

SHA512
a0f630916f5d11ff643ed41ee1f07aa9853f798ebb41d0bf123c6ceff5774605fe17520bf639a8e2e2c184b341ff0f73ab9de58625d11b788c4633d14d7b0873

Download Submit
memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2424-852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download