4e8f628261222075adc219a2eefb6fc2f5bd7d6811df66846677d5a6e5705595

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2024, 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89dafb7d695846572acde253bca4eeb0N.exe
Size

48KB
MD5

89dafb7d695846572acde253bca4eeb0
SHA1

162d4ccf2605491ca3a07829274afda1143cf096
SHA256

4e8f628261222075adc219a2eefb6fc2f5bd7d6811df66846677d5a6e5705595
SHA512

647a675c30915165d6f6a2873ac4dff73d4d958ae18741b034b6c5fee49fddb478b6f928c640e6578d764904f1847316d2af1951cb091afc15048cbda73a9c55
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9DJKGJK9/pZSZh:V7Zf/FAxTWoJJ7ThJKGJKW

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4287) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/808-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023415-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/808-874-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\v8_context_snapshot.bin.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	89dafb7d695846572acde253bca4eeb0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89dafb7d695846572acde253bca4eeb0N.exe

C:\Users\Admin\AppData\Local\Temp\89dafb7d695846572acde253bca4eeb0N.exe
"C:\Users\Admin\AppData\Local\Temp\89dafb7d695846572acde253bca4eeb0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
49KB

MD5
654f5aab516396c1e3646740ca8a40d8

SHA1
4c171b51d7495476ced829f637c05e8dc004799b

SHA256
676d205c258096e64cab5247662945423f9edcfe39850145720eec2bd8547021

SHA512
f10435dcb7da1382d9f4a3d865f0e4629d2e73afa9ef5f2a05109fb0c9f41c5dcc409caa8c1f0bb7f28089611b9aada3e336b02d7d9a6fbaddc0c7a57bd6aa31

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
49ec303a3bfd498498a9887f1c3d4ae4

SHA1
a4025321f619356ff2209081dfc81139f1844c38

SHA256
12e7416703d7eca2ec10177c455ebf5e481ef34b9c3298fd4d2b0c8b741cec7a

SHA512
84c859d7b4633946d52e0aade832db0764d995d6ee0a3f7a61a75d99e8a4fc7359de06539fabf40bc263eb5f2d34ab1b72f4e6a91677029e66b62b35c1f8ce16

Download Submit
memory/808-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/808-874-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download