9b4ff27b886ffdbd1ea2e87e0532be7ea86751773f915ab7043959730061dddf

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 09:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85e92827304c815eb517366f9136c470N.exe
Size

28KB
MD5

85e92827304c815eb517366f9136c470
SHA1

131e5cca61ba5e775ae37ddd4bbdb660274f1348
SHA256

9b4ff27b886ffdbd1ea2e87e0532be7ea86751773f915ab7043959730061dddf
SHA512

6f9ed9378b5a6a5f4f9dab967a0d9a2414f4968b14cd050733182692456182c205d7594b3c8c07b57f086ee2f3877aa1a2ebf366a49565b551e290c13bb0044f
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9ZJ1:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ZJ1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4686) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4160-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233cc-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/4160-1005-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	85e92827304c815eb517366f9136c470N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	85e92827304c815eb517366f9136c470N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85e92827304c815eb517366f9136c470N.exe

C:\Users\Admin\AppData\Local\Temp\85e92827304c815eb517366f9136c470N.exe
"C:\Users\Admin\AppData\Local\Temp\85e92827304c815eb517366f9136c470N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
29KB

MD5
58492728897efa5c5ca2eec649715894

SHA1
201e7e982d300642194c331227eb6c25bebc5f11

SHA256
ed62028e57488a8921b2dac69bd29d9ae1bfb09c461b4777e218d4b6dd177678

SHA512
b45f177925303c8669179f3e236c6463141bb3afbb5806457c2ddb31b88c3737fd5a055702ed2f65df5d280570477c3df8af9940c9e834c50e9a47ad2f398f4a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
128KB

MD5
688456b3450e22f22a532746499ebec7

SHA1
49a0862201e64c5cda39f1a0a5e63fbf25cd2e8a

SHA256
87964f33eec943a6b83db2d385af2913da90d3e2dfad5ef2af2dee655a2313d3

SHA512
9101d53dee1e8d167322116bc6e7841d38c9e62c9e22374fcbd72eedf94561408cf0aebbd3121cf476fc3b0bf5482b07babc82ca55b528e3acecf0344836ff17

Download Submit
memory/4160-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4160-1005-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download