d7ca6d9d530150fe3a3f645713892515adaaaf74380beaad9afa504130325df5

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

946cbd469246c88e78e77c41fdbdc780N.exe
Size

53KB
MD5

946cbd469246c88e78e77c41fdbdc780
SHA1

1f2c1be2117a211ac11e86f123f870486d47d65e
SHA256

d7ca6d9d530150fe3a3f645713892515adaaaf74380beaad9afa504130325df5
SHA512

2c0437f018478b1b6c65f14bc71fb3ae68d1a21432047d354f17ec9a9224f96e2b84ddb8165e575168c83d2953e82844188600018c349d54c9092c30e2bb2693
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdD:CTWUnMdyGdyoIOIZgv

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1500-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002355c-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/1500-858-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	946cbd469246c88e78e77c41fdbdc780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	946cbd469246c88e78e77c41fdbdc780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	946cbd469246c88e78e77c41fdbdc780N.exe

C:\Users\Admin\AppData\Local\Temp\946cbd469246c88e78e77c41fdbdc780N.exe
"C:\Users\Admin\AppData\Local\Temp\946cbd469246c88e78e77c41fdbdc780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
53KB

MD5
c45d9e2de27edd8334df87ac024c6091

SHA1
bd4fb0fa21495e4d0c5dec3052977135308676be

SHA256
87867c57b5bacdea4c77d83cb65b0151b3ef3dbcc31581176d3d0dd07fbcf590

SHA512
c073a9296cc3dd89aa60f1e48f1f0bcdd3fd0fc86624cd6c295a724cd473cf05e2296ed3c4be3e992f62a75698fded1f728a5e72bb380a1bb1744aacd8d46ade

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
166KB

MD5
5e9d328904be3bd0a7dd320e395d91b0

SHA1
bac60954fd620193f88efce395b0f15d21c9c799

SHA256
ea4225d8218ddd6f1480e5f0a8f14f2b1510c9544eac21ffc755e7ad26bacddb

SHA512
82597939f4df6de85e809cac17bca975652fd497131d7057f8198a02401b9996dded413e2f91f65a523a5c63836b94d50be5d5ea30a7e4fcc234d26f9da7f668

Download Submit
memory/1500-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1500-858-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download