d4148be294c2552b0426aa3cd98d7877655a0804fee0ad7949064b06ead8090e

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b866faa9561f7998747fcf29ece8b460N.exe
Size

52KB
MD5

b866faa9561f7998747fcf29ece8b460
SHA1

198fcdc7b39714c536f9e514e40a0ed9bbbff047
SHA256

d4148be294c2552b0426aa3cd98d7877655a0804fee0ad7949064b06ead8090e
SHA512

9fe5d6695fae9ed4c72d66f8ae425fea8a330cfb787475f132567baec807efdf44e43104b2e631d8dd576666437fbd289cb0d3427b31d9d1d5477fab1c32260b
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9HSXM2M8TazTaB:V7Zf/FAxTWoJJ7T1SjTITk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4661) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3512-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a00000002345f-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/3512-924-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	b866faa9561f7998747fcf29ece8b460N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	b866faa9561f7998747fcf29ece8b460N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b866faa9561f7998747fcf29ece8b460N.exe

C:\Users\Admin\AppData\Local\Temp\b866faa9561f7998747fcf29ece8b460N.exe
"C:\Users\Admin\AppData\Local\Temp\b866faa9561f7998747fcf29ece8b460N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
53KB

MD5
281602509c8fcbd9b39b46526b0a7287

SHA1
51ff36128cf8b6b79ede4aa90f863d56ff17f764

SHA256
1ed41b8ba748f90169f73d695db53d9dee71e0c5f4e6a3ce85f45bd328dc60cc

SHA512
2c79bef1c6eec923b67a9bea8b97de5863f5a724e0e67fd61fcd861c9fdeff4eaa746db17057e78dd6dfd1f4fea9b8115503d04c686fa372fd28d7c563517378

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
00f13536d1f73737eec2056890c358a1

SHA1
9e801222672f895493be3b4dd8af7187d544230b

SHA256
0d16566561f2e7a7b723b442cdf7447d508b02cbb8c40fdb0375df35615ab851

SHA512
2c9c7d96c77b362539fa976cf5925ed6e586713f4a0b53016fcd4d2654b52cca7cfc98237288023b798c428dec65cd4ddf536588464e8efe114a312d8e1e9a2f

Download Submit
memory/3512-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3512-924-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download