64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
Size

83KB
MD5

934d8e7820f7aefbd96e7a2d8721a11d
SHA1

c3439204f3586ab7589e52c1b5efffa2d81e10d7
SHA256

64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b
SHA512

231f960d6a82c745088741582fcba1de7f1a810370ed82487d9825dde88438164e68871260b47307c8230e16364405c9bd5109d2937bd084f90bd0e1d9cbaad7
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx4LgLR:fnyiQSoFcl

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4637) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2176-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002355f-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/2176-706-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe

C:\Users\Admin\AppData\Local\Temp\64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe
"C:\Users\Admin\AppData\Local\Temp\64908d648e50d71d672fbe9227a072d860534efd54c0fcd60a27e1b065f5113b.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
83KB

MD5
a00786a885e39947de6b74fbbc390e89

SHA1
5729645deefbeebf79c1a33c45933c58c7e97a31

SHA256
42e6becb0959a4f3e04ac65fd43549a42ef2c905ea5bfacf02a2cac19658ae11

SHA512
9f0f86279ca43db35f15368526f1eb4d5381af870ca4a1a9142436f8301bdc702520ee5fe4fe644ef4b966fb5172c137f6aa9dc7b1e084a2e87d20bd81c81587

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
196KB

MD5
99a9106c4d425281173097440b18806d

SHA1
869db680148723706f3b6d6e60a44f7e2b21c236

SHA256
6bd19d62d6a375d5a78f280e3c78e712a7453fcd08a865815d7a10467e96d9e6

SHA512
fc9e2681884d9e7aa6312ad09a7c37e60b5f9e34d6b292a5e02030f44b685abb0dc35142381a847aa694ddb47376029dc4e73cc88f5a40e0993b358b7a40b0ac

Download Submit
memory/2176-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2176-706-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download