f24406eddeaccd0404b8e0d78495e9a95b1dc6bff87f0b74d83ccc4294c8fb7c

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b40684ceb66bb262497250ba06e06120N.exe
Size

49KB
MD5

b40684ceb66bb262497250ba06e06120
SHA1

040643bae8ce5d58b2dea4906867ca57d4cc7343
SHA256

f24406eddeaccd0404b8e0d78495e9a95b1dc6bff87f0b74d83ccc4294c8fb7c
SHA512

a37de16257aca373d90caa35c117a032b265a99efb9f42c08fac6859358d4b9208320a871e3c3d1323724758c648b51f1c95a75190e9a7b3a05dc27e96bb4adf
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI97LjLNLjL2ol9OiJfol9D:V7Zf/FAxTWoJJ7T1vJv/GV

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4697) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002340c-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/2792-994-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\FormatSend.cr2.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\tr.pak.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\GetUnblock.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	b40684ceb66bb262497250ba06e06120N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b40684ceb66bb262497250ba06e06120N.exe

C:\Users\Admin\AppData\Local\Temp\b40684ceb66bb262497250ba06e06120N.exe
"C:\Users\Admin\AppData\Local\Temp\b40684ceb66bb262497250ba06e06120N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
50KB

MD5
02fffc74dd8dc9926552b849007d0401

SHA1
a96f245ca7963d0624370ebe2bf7f8bb728f0af0

SHA256
fb42169afc10f5f8451b1535e843809c855d00c4b0ed447e67dddc43db8a4bbb

SHA512
969bb1e06fcc4cadf7a466fb0c59685e2279990cc71e159a1ae19e660c043f3be886769d5c377d2ae42950c971b82255e436a6139b40cc51b166ec6e286b3b72

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
8c0e63fd9dfc650acdb99d7e62eaf0d4

SHA1
3856f845fc86be287f9f9694afbc988fda0f0124

SHA256
3fbb235fbb139a63a88dfd7df864e11cbcebfec97bd50b222e3a35fb9d893613

SHA512
ed91502fbe875b1aac9c6da12f944842f828a5a31b4303961f44c582d265df22435679fd0f573df07283a33abddbeea575dda5a7932902b40fc73dbc4ae24717

Download Submit
memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2792-994-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download