d1770b25397198d1ebd6fec64913c8cd60f2d145cba61193b08e5c11545d5891

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d41685ca43989db0bff98c77ef98760N.exe
Size

38KB
MD5

9d41685ca43989db0bff98c77ef98760
SHA1

23816e1e77f713c7df232cacc017b0066d39e6ca
SHA256

d1770b25397198d1ebd6fec64913c8cd60f2d145cba61193b08e5c11545d5891
SHA512

b0f252d12cc6e30f35bc89cb9a08be42c17f2399272fe02403c1527b7a4734a432d2f92f5797eaaab6cf879d19ac5fdc9a9e486cd6db795f45baed2167499996
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATBWvyBh85c54wo:CTW7JJZENTBWv36G

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002362a-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/3312-799-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	9d41685ca43989db0bff98c77ef98760N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	9d41685ca43989db0bff98c77ef98760N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9d41685ca43989db0bff98c77ef98760N.exe

C:\Users\Admin\AppData\Local\Temp\9d41685ca43989db0bff98c77ef98760N.exe
"C:\Users\Admin\AppData\Local\Temp\9d41685ca43989db0bff98c77ef98760N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
39KB

MD5
493f444698da631ce9ed3b2825d9e87b

SHA1
679f16fbbb41a396dac464760863bbaf49031a2b

SHA256
b1f24ee9472372a064f8c37df6d3912f4784babd52b25d0201c5b1477a83abf3

SHA512
004ccfaad84346c4104f624ce75c0a60dfb90e1759296caa455bdd9f2e43c3ec8ccf37921cecdc6916d4ff091dd023d91280462dbbcef1c203b8a9e6fc6c4d1e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
151KB

MD5
64a31828df7c4ada79da36fe7ba38322

SHA1
d0950d24bec149d0d19418dba0f3b8d79c14e5b2

SHA256
085f0eade2fef9c6c9c2f40ca276f8bfa64867ee32ec5115a8906d413d89b24c

SHA512
ad9af9d3fe0c54657c4c54b83c84ac12cc1c215a01e5549ded305fe6dfcc196eb643673cc052524ddd3b145b0d39dc0a2d600f2d8ec4582083b36bf510858ce0

Download Submit
memory/3312-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3312-799-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download