780187ba2697b2a800575922995524636ceb884665e2ee94657fd95e0e416054

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
Size

138KB
MD5

47663e8ef42c96bad7dddc67d4f33a9e
SHA1

e59c48cf9298f062be2775378b7c1898d2bc41ed
SHA256

780187ba2697b2a800575922995524636ceb884665e2ee94657fd95e0e416054
SHA512

5fda735621a8175513fedb5672dd003131ca98372c6e3c9b56b8a792088a7a22b17e894a6a258cc419e0cdc0eb2bccd1eaafc19349cf5814a6af32423de6cb5c
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZTdTWn1++PJHJXA/OsIZfzc3/Q8IZTt:fnyiQSo7ZNQSo7ZZ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002360a-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/4460-612-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_47663e8ef42c96bad7dddc67d4f33a9e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
138KB

MD5
e2c4516e4182cedbb67ad518ba37f90e

SHA1
b1c53814e1fa1c7e50b8e3f777868c5aa4546fc2

SHA256
daea74427a8a05c46bb176a50f0b3ec12a87067c2084cde10819ce741484b225

SHA512
5b97a35ffcb4d2bfa5c739680a373230df8ac2b3b3911c9b04c1e60a200d04c64f55f94d288cd2c274d8b9ae4fd04160f3c3117fcc3ab367ea508dc7806ece81

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
251KB

MD5
be3636bde231c2c5c54ec748b5787d62

SHA1
7e1f05a061c700eabe4e92a3853ce470dcb5c303

SHA256
950b359bfda5278fa5c30c11ddcea4e7464fcc342a7adbc3ed003171d5adbe4f

SHA512
0c6f6f1f1565b9fdb35774d28ab6836ac545e35eb1d8a91753237e8872ad72533f2e868fa68ea48efa14e73d5b364f8c0b2dbf0350a05ce75f49fbfcb893620e

Download Submit
memory/4460-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4460-612-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download