89115ec35d2bc6f0e02e2003f4fc9a58dc69a66f47da7432b4526f05993968c4

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28e860f4ac9445aa9cdf1401c58d4420N.exe
Size

84KB
MD5

28e860f4ac9445aa9cdf1401c58d4420
SHA1

838be61a0f34e1df475c2a10869a39dbaa5ff629
SHA256

89115ec35d2bc6f0e02e2003f4fc9a58dc69a66f47da7432b4526f05993968c4
SHA512

418615d4a424a9970c21828f709b225fd0584c2b046eda8cb939b87a85339fa0fd40bd17e831e8803f7449fe2eae4af2b5756f3e633bb7d1077d734c9e26d9b6
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJ1EXBwzEXBwdcMcI9SBo7BoABT37CPKKdJJJ:a7ZyqaFAxTWbJJ7TXTW7JJ7TaDvDO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4616) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4472-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023448-2.dat	upx
behavioral2/files/0x000800000002344e-6.dat	upx
behavioral2/memory/4472-850-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	28e860f4ac9445aa9cdf1401c58d4420N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28e860f4ac9445aa9cdf1401c58d4420N.exe

C:\Users\Admin\AppData\Local\Temp\28e860f4ac9445aa9cdf1401c58d4420N.exe
"C:\Users\Admin\AppData\Local\Temp\28e860f4ac9445aa9cdf1401c58d4420N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
84KB

MD5
6634280765ec60a5166d073317a934fe

SHA1
e14a9145ddf1e5f0980a1449495f62992cc4865f

SHA256
af4dd09fc2b4a80b2abcb67821e61db83741cc9f42f9364458a68c34764f58b7

SHA512
2da701707a1ec14d3d2330fe7a0b5c3d37e2c7fbe1b14af25a890c0e029acb84cf66f0db9fdbb74df2e1f89d0df0a3ee350446afe423f89e5878d15b171167c6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
c890fe937dd9810c6b942ede08dd253e

SHA1
a6319e9a554f77474eb219152c90d09f53df214a

SHA256
698e8c4b311913e9c4ce9c5a18e3b770dc41f17f981f71454f3e4a38c28bb9b5

SHA512
73bac484db24f3d578c07b36b1c48e57ec0920e41d77a72b2d06d54516a4f0a3d246080b7c66fb4e2a39fe75bb97954213b34bbf4abc9d505c5f509050575576

Download Submit
memory/4472-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4472-850-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download