7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
Size

57KB
MD5

818b14559fca63282adcdfa8c9a2166d
SHA1

a3b9e25362c4b4d9af991268c55e6df9867a100c
SHA256

7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52
SHA512

4e4e9b7caa7018d7ece91930818e6ec1c705f80722d708f070a8d337e43b187a67fcdd4e98bc163bed2059dab497aec1f7f1779b9f209f6129e9d9a17bc99fac
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9HxAQwC:V7Zf/FAxTWoJJ7TAQwC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347e-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/2120-852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe

C:\Users\Admin\AppData\Local\Temp\7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe
"C:\Users\Admin\AppData\Local\Temp\7b481963e03f7fd470ad15abb3dc19b897efb7020e2f81c0f8177a451d7fdd52.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
58KB

MD5
972988c7ec5c6bd843becd1170d6bbab

SHA1
15872fbf4cb23db8590895180490eaf9e69063ff

SHA256
69688850e2b767d2ef2b2a0210072c15a10e51b12a16b42fc23b64993941e656

SHA512
805dd9118c9c8e2eb49bb3228bc1380754e52dcc611587f0e141c12f6233c680ed85946a06e8664f3853be78aea98c9804983a4169165cc87924af13759bb576

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
b645239d6572afde020d9826cafc766a

SHA1
7dabd31bff9b219f91dc41badaba4b8075ed5953

SHA256
a8e0985025501af71b884f7e27a8582299991543ec319244891e4ff0f06bec4b

SHA512
4592829f9b704d85c255e106f093eda098ed6aad7f5fd3859cf187d5a094c9bced67286c7118f6ba4ea15976692a5c6ec257d197179ae16898a30549bd6678db

Download Submit
memory/2120-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2120-852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download