ad874b184f5d666397d0a855d9a956779d6383a5e32866a40e53bb659b9d4d05

Analysis

max time kernel
119s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d700070d5504f819a4eab51e1859b290N.exe
Size

69KB
MD5

d700070d5504f819a4eab51e1859b290
SHA1

0e98bfeced675f7ddde82c67729b60a3a67a75f1
SHA256

ad874b184f5d666397d0a855d9a956779d6383a5e32866a40e53bb659b9d4d05
SHA512

4d2bfefa4c3db5a92b0578ba179fbd63615624b17b927435353835c651dc0d1545d11470bb8fcc71e5ef71f577d97f3e10192aee16b1fb04e2c881bb5c002d3a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiMY69Z8bi:V7Zf/FAxTWoJJ7TTQoQMY6IY6S

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023414-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/2360-872-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	d700070d5504f819a4eab51e1859b290N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	d700070d5504f819a4eab51e1859b290N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d700070d5504f819a4eab51e1859b290N.exe

C:\Users\Admin\AppData\Local\Temp\d700070d5504f819a4eab51e1859b290N.exe
"C:\Users\Admin\AppData\Local\Temp\d700070d5504f819a4eab51e1859b290N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
69KB

MD5
5993108a018f39ed190a15f53aa33202

SHA1
e5663a1ffb665943f8fcac06abda73de8ddc1f8c

SHA256
1caa5d4df7a58d3c580d08eb8f358b5531110e47d10078b52dcd76c120fd7572

SHA512
a68e5304e56398ebf53fedd1fb3d266fccad2158f43aca4787e830d3efcd94ba8955374b270d89d0578ebec4cabeaca36b6f0b4c84e01a774814e9b5fd2fa3c9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
349c8c85eb7bc28f3bce01771305484b

SHA1
12018f8b991aa52f84deafee1438338f86fd4fb6

SHA256
028e981652db550f73526833f7b495c9455d43e3406ec974a1adcfe72cd35bc5

SHA512
ee57587e5b77efb15a9e184af88debf9f3b712fbe3577f6e1c0fe05d3e87893bfebf5a28710daf7f723f4153316c7071e3bf3578302e99189afd8b06dea0a321

Download Submit
memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2360-872-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download