f0fae3ba80686d25a62a2dc60043908de4d50e20a1ad9583cde5e6ea39365464

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfb619759278fd09cb886a0dceb6900N.exe
Size

49KB
MD5

7dfb619759278fd09cb886a0dceb6900
SHA1

c772145005f5c7f7df8f29c117b5cb56d42cce7c
SHA256

f0fae3ba80686d25a62a2dc60043908de4d50e20a1ad9583cde5e6ea39365464
SHA512

85c6f87600d0c1b7cc5140af98bb500b3b205dafedcf24106bbcb327e3e3a7b05a6140e09a14c5568182c913aa2203a90e07d2247e4361a1db46c1e50550caa2
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeinMdy:CTWUnMdyGdyoIOIN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4679) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023404-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3152-908-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	7dfb619759278fd09cb886a0dceb6900N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	7dfb619759278fd09cb886a0dceb6900N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dfb619759278fd09cb886a0dceb6900N.exe

C:\Users\Admin\AppData\Local\Temp\7dfb619759278fd09cb886a0dceb6900N.exe
"C:\Users\Admin\AppData\Local\Temp\7dfb619759278fd09cb886a0dceb6900N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
49KB

MD5
3d56a6dbc28a00adc91fb1a7795d57cd

SHA1
8e6e83aa72c5cdacde0417a15bcdddd683abf968

SHA256
3ca3ea29badd6cf5e7d355251fe4a733f0b3f9613df44b39faffe067306743c9

SHA512
70f378073a115e4e262b0e4b6821a45d665342dd507d88ba30eb94342147d03eba86f88862f48005cd691d7bd96f8745ee36ee64442b99ac01556653f8405668

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
b069e4a5ad6e6404bf9bcc7f0171b2dc

SHA1
509a21aed74355f61298e25facffe6f2a204c7a6

SHA256
1a393e6a59818a2649e9c9f7131e980d47e7e433f0466da2fb452479963832a8

SHA512
18517b16cce1901d44adbd5bd230e6631bd62dea287fa1007f2a30b6a85d559e5906e4c4651353f42ed97b0d9a008e4b2bf1c8e546df3e75c6f58a8ebd36d4c4

Download Submit
memory/3152-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3152-908-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download