08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 10:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77a0d9c8ac29df3229cbaa9738f77340N.exe
Size

80KB
MD5

77a0d9c8ac29df3229cbaa9738f77340
SHA1

e120df75e837a84a532af69162306968c22a1ea7
SHA256

08f7a84b4bfb8ebb081e5bc2a98fd3610e7e01ad6d0e3cb13e6536632e636508
SHA512

dce5e7aa2a97df7cafdf56ba230fafadf75334eabd27d7fcc1a2a5189a73c87cc4745a473b9d89a04eeb392d0dacdf4e97fca5d9067ebb7033a7cd25b9a30ad2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTj:fnyiQSo7ZP

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1664-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0007000000022aa5-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/1664-798-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\DisconnectUpdate.js.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	77a0d9c8ac29df3229cbaa9738f77340N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77a0d9c8ac29df3229cbaa9738f77340N.exe

C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe
"C:\Users\Admin\AppData\Local\Temp\77a0d9c8ac29df3229cbaa9738f77340N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
80KB

MD5
dc422220f4c35b7e90dcaaca9c483036

SHA1
39824f97a2d1b4e62aaea4b97ce30e1805443133

SHA256
d908669bda5b183f2eaff34568ef3c65c185202f74a829abfef6597c04839d0e

SHA512
838f5a0dcd132f9655d26e476e31865c03cdd8ebca038f6561e6f7131fcb5d47765b4b3c6621f996e436c81c68bb8011adcdd5af17be0c930ac93c6e48dcce55

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
460411a74790d123ed102b10598b5316

SHA1
725b752fc825e068993c6feef71b8d959e6cd798

SHA256
a65e2c750ab7b7a7803c820c0ef25bb2735fc9c0fe7c69e90718891f39b7fa80

SHA512
6d9417177edc23d879e73e66d08640e0bdf4ed46b26e30d2673858132b71063940048399f55c785be248197de97e8dd04d83893a20e928360a187c1c0d30b1c2

Download Submit
memory/1664-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1664-798-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download