d15df42e568ace459f60d5fa2d05d0f3bc510a3e499abf70aac26c5e83d487c9

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb2092ba2a45a47ee9af5b98b95c0330N.exe
Size

125KB
MD5

bb2092ba2a45a47ee9af5b98b95c0330
SHA1

6f873508645a0ed386bb98df0ca6d3bb340072e2
SHA256

d15df42e568ace459f60d5fa2d05d0f3bc510a3e499abf70aac26c5e83d487c9
SHA512

3d9c83f5bdd5668279c2b2f21b68da5807ac5474df33953906940e0e662ad0513c01266a53c4997c40d00e473438b79074e62d555c3c0a484c1e2aa57ab6eb9a
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5DS7TWn1++PJHJXA/OsIZfzc3/Q85:fnyiQSox5DSvQSox5DSNQi

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4359) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023480-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/4936-840-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Primitives.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	bb2092ba2a45a47ee9af5b98b95c0330N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bb2092ba2a45a47ee9af5b98b95c0330N.exe

C:\Users\Admin\AppData\Local\Temp\bb2092ba2a45a47ee9af5b98b95c0330N.exe
"C:\Users\Admin\AppData\Local\Temp\bb2092ba2a45a47ee9af5b98b95c0330N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
126KB

MD5
2feca92b8041629748ee85a1fc101016

SHA1
a4303b01fbd7cc6759feefaec334f33b01dd4206

SHA256
87a6e90683f4946b95b9e1542ff736c4e885149068667b48edfa63b8236478cf

SHA512
b198a24291e44dc381bb32ab9a26e55b6ae6e39a36763d1555aed4516e3bdb3fe2f997a73950a4bbdfe198413444bf38ec4e191b1cdb0506e0d74dfa158e2a8b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
224KB

MD5
5f014c6a4353e7db9e0c8dca9da4d7bb

SHA1
c797b1bbcb1c5bfe1698ea64ee86120743e333ee

SHA256
84f065eec96b643137567f540d3bdba8807cf928d556cae6c02b96d20036550b

SHA512
58c032b1297196d236198ba831a9d6c172b150824796b6e6c9b8b6d98f2901765302d7b9580d6667b0113dbfc210eadefc53b0a5a7858da72129520e699a0274

Download Submit
memory/4936-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4936-840-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download