31a7d71b1d6a369df43d07aa6a5a946c0b5edef08154fbc669a0b5a6eb1c6be9

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72cd4dd55f39ac3e174d1c51d7523e10N.exe
Size

61KB
MD5

72cd4dd55f39ac3e174d1c51d7523e10
SHA1

9e8b74360127c7e194b8ad06ba148816ec97cbe0
SHA256

31a7d71b1d6a369df43d07aa6a5a946c0b5edef08154fbc669a0b5a6eb1c6be9
SHA512

a233f6d1d6702a3eadfede89c935d9ba6273282d6a2f709f168622b2f6437617cf17d4eb3cb84b81ab7a62b2555bc31b14724b22f7f1404155ab77d5bea7b311
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9P8Mz:V7Zf/FAxTWoJJ7Tf

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2072-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023440-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2072-794-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ta.pak.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Dynamic.Runtime.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	72cd4dd55f39ac3e174d1c51d7523e10N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72cd4dd55f39ac3e174d1c51d7523e10N.exe

C:\Users\Admin\AppData\Local\Temp\72cd4dd55f39ac3e174d1c51d7523e10N.exe
"C:\Users\Admin\AppData\Local\Temp\72cd4dd55f39ac3e174d1c51d7523e10N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
61KB

MD5
417b5e344dcc591456b8533b09d9fde0

SHA1
0922e57f84497e525b6b3562c5202fa09914ec3e

SHA256
bc13f846339f4535c6055f4cec7aecbff8822a830c73f49d4058a7cd11cbaafe

SHA512
a0bef30b79a80a096b2a13a3868e027650d1974255827cafde36b1078aed0656cc85dc2c7f75c8d446e8c63f009675baeb1d6bcb7f5e3833a40e409e19f27e4b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
3755bc7032cc15dcc83ee66cffb9e8c1

SHA1
4a3f5f9335b0d642d9bd0291c0ce6447745670d2

SHA256
e6a246374f4d5baf981bb31e3a47130b178bca1338ae1ebd7564725e77ddf5b5

SHA512
73c255dc738f638e010e6c75834babf4d4a5dfec41de7bd08248d82d2e2cae1d988a1eab316de0c267f57ae5119cd3cc069baa08d0af0197a75d5e403c787308

Download Submit
memory/2072-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2072-794-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download