589ec838c6330bdc01a93a90da5c232396224069c35c791a831af02a5df6833b

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72a130a24fb4e8b798c303219bbcb310N.exe
Size

75KB
MD5

72a130a24fb4e8b798c303219bbcb310
SHA1

480a002e2ef3be19758c05c50c350739a6009a83
SHA256

589ec838c6330bdc01a93a90da5c232396224069c35c791a831af02a5df6833b
SHA512

a4cc14b070ed7e0b5a8a6ab96dbcb77dbdbe65f57fbfacfd71b44743c0bacd138a92fa239686ddc260da6ed4d36cef7f706523d33b055ce953c79f0a1f6dca15
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDxf2wzwpQ4NQ4t:KQSodYeHNmkDxfvcp9N9t

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4360) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002362a-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/3312-807-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	72a130a24fb4e8b798c303219bbcb310N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	72a130a24fb4e8b798c303219bbcb310N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72a130a24fb4e8b798c303219bbcb310N.exe

C:\Users\Admin\AppData\Local\Temp\72a130a24fb4e8b798c303219bbcb310N.exe
"C:\Users\Admin\AppData\Local\Temp\72a130a24fb4e8b798c303219bbcb310N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:8
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
75KB

MD5
d86192ce41747f752d9187b1684b7b53

SHA1
9fdd6fbabe888cb21703666e6ebd7c1822dbf4b9

SHA256
1c4ca9815446417170e338e95407d1d2dd015a5d2ec15bdb7c11a7ecf43ed95c

SHA512
0a96449dfaa5892a06cf91bbdc42b1a96a8bbeb068a7e4a517896f477c0774d17eadf2b535d9ede0e8eef62163c4999ff03b2b0298bd9a6af02fd8c100167bbf

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
187KB

MD5
668e6e38f5d2b04ceff2216d7d126268

SHA1
782aeb7d1cbeb313895f23901425117a25ec77ab

SHA256
95292018f9213d19dc403c6715dc122866d05743921ddd68d2d8e0b3a135a674

SHA512
e3f280f461b25c46132ce7334e59163ee5618364ec0f863e855eeaca68b77da03a6ad00d17fc938c74f2b2d33eebb20f51eca394d267caa9463cf2533cd0dada

Download Submit
memory/3312-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3312-807-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download