0c71a663a0a88406c19b46ffe119f1a539c71599c467caba1e951554485f8514

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73d2ea55c0b9ea76563e4c6033600800N.exe
Size

59KB
MD5

73d2ea55c0b9ea76563e4c6033600800
SHA1

5058e9c40ac64b3de859380688dd5442674b4832
SHA256

0c71a663a0a88406c19b46ffe119f1a539c71599c467caba1e951554485f8514
SHA512

f0578505e13f7f46cb01438bff68043cb33360695684a0eab2dd9713a3eec377ebd55cc164c560ca9f33eb84d0297042455d95325e8173a8c75a51ca46dd702f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Ti9Ei9+z/:V7Zf/FAxTWoJJ7TV7R

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3092-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000235db-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/3092-808-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	73d2ea55c0b9ea76563e4c6033600800N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73d2ea55c0b9ea76563e4c6033600800N.exe

C:\Users\Admin\AppData\Local\Temp\73d2ea55c0b9ea76563e4c6033600800N.exe
"C:\Users\Admin\AppData\Local\Temp\73d2ea55c0b9ea76563e4c6033600800N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:8
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
59KB

MD5
2493f13b727c362ceb18d531b8660f2d

SHA1
8d79a70843b5f3563b28145e32c2ca7de50ab44d

SHA256
d36be8b9ee2e734caa9661c2e13ee9726e74598bd719da2cb38d9c38b8c5d15b

SHA512
8341dfc14a14815862bf170422bb9656a2fbb867a1180f238a14805be9c9388569b77f7b22d04b2c04933e06357e5b0afccdf76f45bda5492f7230c7ad3138e2

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
172KB

MD5
4f3e28dce4fb11dd029cc1aa1918277a

SHA1
2b160e25b67f3350577d9b08a98ec07e993aba26

SHA256
a42bfb079e07df30d11bcbc459034936fec1b0d9cad673393db99bd55d9aee0f

SHA512
1996234ef7a952a80657d2ca2493d5e3e8444508392556f3e75c13f36cb18b536b9371dd6138fd9a9e2321096105f5033b5eef1f74bd42ea1db71bb710f716fe

Download Submit
memory/3092-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3092-808-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download