d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
Size

65KB
MD5

0e751f1700cbe74aa306cee5aad4e8a3
SHA1

01c0adbc80f475a4e1eb9b2691f39e964a3377f5
SHA256

d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0
SHA512

e3ca87b3ee97f4d82fafb5f9dc7496e5e56cc0b520b694e0c2751935792afcea1343080b67791419a0ce76b33f4e881f3df38d92fc1817b80033b05ac4680cf8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2ry:V7Zf/FAxTW/ySSh9j+9jpGnNBBBR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/412-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002346d-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/412-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe

C:\Users\Admin\AppData\Local\Temp\d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe
"C:\Users\Admin\AppData\Local\Temp\d35d08493084ddbffdee821195db4c28b95e278d8fef42cc8133a95140c0f3b0.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
66KB

MD5
6213d2c5c2d9a8e3d8052b179a98409f

SHA1
980ea7010e16fd53b107e702f25a2780c1e37c7b

SHA256
c0ac189d4d1ca8f78209a853b95b460b97826e07736ede35da6409bbc82a8ad9

SHA512
7d9ee9ab93b87bcdbc4ed074180efb30e06811be7bab86ad74a96837befc1d00285ae3dea19640d834983ee73206bd6b795ae885a6e3ed5d397a6726b24c748e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
164KB

MD5
e0aae73a65184c1e8c6a5ac7a2230db1

SHA1
4c5152e545a190fcc96e22eef63939be4ca07cac

SHA256
b99c7adb4e22e80a96398a9f99d4ab3d5313c0c43b8f68af60abcea22e31aca0

SHA512
9df05288ac5c166be4d420670cf2c04bc1eaff7fdd218d84fd53b44263d8f28f441e60d4a30f9958bd7ab3f24011c2d66af63febcad05de5c0693105626dc604

Download Submit
memory/412-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/412-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download