8078f92f571daf0ca0cc20fd9f315ca11563fed89bccb3f7dca9f78fbf87c071

Analysis

max time kernel
120s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bd03ef4f42b221c088ba161e7b947f0N.exe
Size

29KB
MD5

9bd03ef4f42b221c088ba161e7b947f0
SHA1

893d809885bb6f355c4abeebc7a31876675883a4
SHA256

8078f92f571daf0ca0cc20fd9f315ca11563fed89bccb3f7dca9f78fbf87c071
SHA512

ecdea8e69fd2b6b62402d9f2f2461edc9e60211844382d16926ae9463f9e48bd664f2cc8518f5c45eae139a60487ec1108b1a1b4302c6fdf1e7ee4792882dcd7
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATB/yNhPn0DPn0n33:CTW7JJZENTB/oP0DP0n33

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4712) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5048-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b0000000234da-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/5048-932-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\ApproveReceive.dxf.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	9bd03ef4f42b221c088ba161e7b947f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9bd03ef4f42b221c088ba161e7b947f0N.exe

C:\Users\Admin\AppData\Local\Temp\9bd03ef4f42b221c088ba161e7b947f0N.exe
"C:\Users\Admin\AppData\Local\Temp\9bd03ef4f42b221c088ba161e7b947f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
30KB

MD5
6cf12204ad4b97320a5178da4dbef191

SHA1
200f051aae4adc52a8ea0f73033d9d0381c3aa90

SHA256
92dfbcb050580f053855734fea62980baabc5b3e9055d197ce76833dfc82e9e4

SHA512
121b33596f76e110f0efe47d4dfe3c74c73ffbeea54c881cabd704e0fd75619f73e7ecf509deed7dfc9868924241dd807faf482ec6437572d32775c3e8a6a62e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
129KB

MD5
bc631dfc5390a564f1d7b6fe33dd31de

SHA1
f704aa6b403df10789d0a7de562c180bd546c362

SHA256
002d6dc49a2469c47c2075f32b5b5dea02c06868f5c2c17a3772d286d356496a

SHA512
3b8db33a21356bdbebe680de6d8a6af33a1060cd5506cab01e6cb4f6f0274b9d56959ae38d1d2fd4c10b6b59bd9550ffbdc59bbf1a3a2a12115782fa73adb2ca

Download Submit
memory/5048-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5048-932-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download