db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
Size

66KB
MD5

0582f930f358d0fcd2128000b0b6a617
SHA1

d3d0d1f850b00c62b25cc55978b2269573e28115
SHA256

db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52
SHA512

a20d0460c606d62b4c91a9ea1d4137177bedd77c305c2ab7dd6cd9b08e7d5e9cbb145424c0272bae681bb8115c48efa43e4b1b3eb2ed0abf6a264540caaa57ac
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tih3y3uP9+:V7Zf/FAxTWoJJ7TTQoQh3y3vwOgrwOgH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1900-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000235ce-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/1900-854-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.RsClient.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe

C:\Users\Admin\AppData\Local\Temp\db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe
"C:\Users\Admin\AppData\Local\Temp\db9ba5c0122d8d9eaec043f07f9e1c4751d9e93af7df30b4f7e71dbbdc156d52.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3364,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
67KB

MD5
348e4f6852f5760cf9403f3227b9a4ed

SHA1
b81a976058e15aaa9cd52a3f8d0a2aade5490e86

SHA256
0091d2bb926d2b6bfdf0fede787822d738ccb9a5ede2cefbec3d6bc41dec6edd

SHA512
528c05eb16a0d7c2c214c971a5163fa965a64e519598422ffd9a727e9e7be94a630b624b36d9d6a172bcd279a3517536b5d17af7bec5f296a75a027ae00e0395

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
179KB

MD5
b4aee2876c27c39e3b157007e720f63d

SHA1
01fcd8d71fdfd59f8b654f46b9e22cd54652c16f

SHA256
1d17467b6af622e6e192e761284ac2c7c939e5d858a99630480b44b94c82992d

SHA512
8197402adf9c118f982c20514cef2c98a83212abc4243416f82bc26b1067c2a996b88f5202b6678fb7edc42e2187631062efcfe452e146bc32c18b5557a77271

Download Submit
memory/1900-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1900-854-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download