9d9baef530027e2be7b80279d8d95393a1c45b47849e851c759610e85627c81a

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3ebdf27d80a99ea8988060c4c35a4e0N.exe
Size

38KB
MD5

b3ebdf27d80a99ea8988060c4c35a4e0
SHA1

4f2953a7b03d994b0c153687ea4f956f5f124254
SHA256

9d9baef530027e2be7b80279d8d95393a1c45b47849e851c759610e85627c81a
SHA512

077a30209b9165a9108ad181176ba66a558378bdc1e2a5bb48698f3aab75e148aaffea2f0ad1b3c72237e71f65b646740f0a3984762d7e0e0b6b7f17a8edefd0
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9ADJ59ADJsd4C:CTW7JJZENTNyoKIKMd

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2164-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b0000000233b2-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/2164-908-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	b3ebdf27d80a99ea8988060c4c35a4e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3ebdf27d80a99ea8988060c4c35a4e0N.exe

C:\Users\Admin\AppData\Local\Temp\b3ebdf27d80a99ea8988060c4c35a4e0N.exe
"C:\Users\Admin\AppData\Local\Temp\b3ebdf27d80a99ea8988060c4c35a4e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
38KB

MD5
fbf4ebda12226dd4727c3d3f276a31ab

SHA1
35c06f663fd12dabffcfb80f2bec3af3cb79dceb

SHA256
95f9ca2ae99b46c01e18d9fe6b10e63e31aa8f13d7c0ec82fa9bc152404aa01d

SHA512
bec56281032196db1ebd7a5fe73e480f0c1e3dcc26a20f02640174204a120befae7012641f63b42a049b63c71bcb24f7b4e5b5ad78201748b267f8df0094cb01

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
137KB

MD5
141f1620817d7ff5424d0391987c732f

SHA1
d2bb4a2ee51b011886c2ee765b0e51c15e7ed43b

SHA256
939e1282427acdbc191adab9945e28060d4317fe933647406a5204c739a0667b

SHA512
b1c8c2ceedabefaa4171d7f4f2ca53b5c6d7d25b71415420f0175e4136f7d859b8e47266895ff929dd795f4f31d3e30be8415fcbe5c918c5e5207c78bbbbd0ac

Download Submit
memory/2164-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2164-908-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download