60ac209b588abcf68eeb2456c10744aba3d129e092b36edeb93658dd29cc8db9

Analysis

max time kernel
120s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d031564c191c853b1b0737e0f2e2920N.exe
Size

84KB
MD5

2d031564c191c853b1b0737e0f2e2920
SHA1

0e0540bf61545354a7134499f06ccdfa3f8f1429
SHA256

60ac209b588abcf68eeb2456c10744aba3d129e092b36edeb93658dd29cc8db9
SHA512

840a7ef66967355ef600fc4034c08651f8a3ac716f140494c92cf1a1aa62a079db6904a8c467dc8f9614f3de9d03bf3d38954dc2274271719fdebabe0106f07e
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZTgZtZhZtZI:enaypQSo7ZsrW

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4516-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000236a0-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/4516-804-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	2d031564c191c853b1b0737e0f2e2920N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	2d031564c191c853b1b0737e0f2e2920N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2d031564c191c853b1b0737e0f2e2920N.exe

C:\Users\Admin\AppData\Local\Temp\2d031564c191c853b1b0737e0f2e2920N.exe
"C:\Users\Admin\AppData\Local\Temp\2d031564c191c853b1b0737e0f2e2920N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4208,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
84KB

MD5
0a732d0f7cd119239994de4307df7f22

SHA1
08c5a73335658b4f56afd2edab20e71a087de5fb

SHA256
a7bf450ec5919096072f18735abdcdfff5e909f5a6291b7bbdf2038337e564a3

SHA512
b0e271a8853cc08d6c1fc3608771c30489a15963b39161e4f8e0ea11613cfdb93be733f0b341d8983172bd3d3f1341d2f80bcb1e96457f7e7c5d03c6b0a799ea

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
196KB

MD5
01ab13d121116994cc9a621f59db30d0

SHA1
b033fdbbb48a3bee0fbb76aa4d24e233b9187d18

SHA256
022d5a6fe4938c8d0291826c94b53e50f25604f6a5bd8be38dd7b78fcaf88ffa

SHA512
beb662617492f3600badfd31715a8adbd25912c6ae013d6c580a00368a3e3b5b3a010d0dfb171165d9744dbd912bdeaa80d6162de413d5f015252d18a895ed18

Download Submit
memory/4516-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4516-804-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download