85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
Size

26KB
MD5

2ef1ab3680905f42e4106bf6b6802063
SHA1

db2c8a225f03e8b5286272dc40cecbcb2991f375
SHA256

85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3
SHA512

6003ef1e868ea0388e9cf6e874ca6644430a8cf1bb68cdda861f027f65af2a395683fdfd684a4bd4f7a1b6f606a4bd383df36f3fc65618607fa81252f3938730
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJIZr:CTW7JJ7TPUd

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/228-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023424-2.dat	upx
behavioral2/files/0x000a00000002347e-6.dat	upx
behavioral2/memory/228-932-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe

C:\Users\Admin\AppData\Local\Temp\85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe
"C:\Users\Admin\AppData\Local\Temp\85cb532f494bc969059817b97d9424ae6528feb12febac5088c33e9c99754aa3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
26KB

MD5
5bc907acae4a6895e72e5aeb2c4a13bc

SHA1
12c6058f94971f20a47d513e9097d61a4886ea30

SHA256
0f008a208d65ada5fe6cf2873250d1e28d0274a8a06d985804b7e6484205b3ef

SHA512
0bf4269f14a25c64200c28bb2aaae3fe915545e39c4030cf1031fafc8de88ff705606430d954da53322d85acb0718b162d43241b56323dc7835b998c16ef1a73

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
125KB

MD5
b955344c971a473f21a9ce76674f5dc2

SHA1
a3ad87f0f1cafc59cabcc3c06a895a7a1db05437

SHA256
0f0a47ba893754e4d2602c595535bef7e77ed208e7a1e3e94517fc7255475861

SHA512
08fd5962dc78a90687bc71c85952cb4982607fb42a596e6b83ec587c015e4a86bd2d24fa4e810c4486345970871764a0f42ba4f24bd79c9d7d7293f6ed399b2f

Download Submit
memory/228-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/228-932-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download