268b0bb7f1cfc26b4c6b1a41462e9898a39b35cace21b708f3c61e1026ad1893

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
Size

66KB
MD5

4ef59e097da7416c19a723eed29762fe
SHA1

f2a4f4dd0d024ebfd29b94e2f1a1b4cd01cb0ade
SHA256

268b0bb7f1cfc26b4c6b1a41462e9898a39b35cace21b708f3c61e1026ad1893
SHA512

1515108c9e16849ce5e95f6591b45380f5dd16534011070d326d4f86d7cb462cf680e81cb0b6ace53746c19a58ed72cde9f3463b9d292080e5bb59c1a9d012d2
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZTkb/bM:KQSo7Zgrg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4373) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000234a8-2.dat	upx
behavioral2/files/0x0014000000022936-7.dat	upx
behavioral2/memory/2984-761-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.V7.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Danger.ATA_virussign.com_4ef59e097da7416c19a723eed29762fe.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
67KB

MD5
fdf1f2b9f0cb055e36a80fc5338570a9

SHA1
f27d1ff2e4f907a9ba1aa5c99235f9d2a855082d

SHA256
ba70059c111c2b46079b545b9fb1f4fc30ca07f419a6c850956c921d30d50509

SHA512
6355313853c19940de53c35a1d456c37249f30b7c6aa49cfdc7f0f6136a8c8f73e5e9c9d575562beb7b9e4a55fafa4906aa602596e9c008eac5980fde19758b4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
165KB

MD5
6e8e8ae2abd754ac11a737b4dcb3ae56

SHA1
54c60f040313d3cd1ff3c7700976bdc40a5da249

SHA256
8a15f4e4d3f41b3392c552c6b25070769fda20ea2587b03094268354313ed14e

SHA512
ebcf05714d4506404cb5e5abc25c70c651fa92a3d01216fb64ed336a2486d1c5101efee6a86b4c6a767a8d9ec897ea6d5f55ce2689fd91bee530d8702fa59211

Download Submit
memory/2984-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2984-761-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download