26912bf6629ee4af0c6930c821096981b279246dd773c72a0eb92d79f7f0601f

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c91658f0a08f73a863b30e9a93ef0000N.exe
Size

61KB
MD5

c91658f0a08f73a863b30e9a93ef0000
SHA1

c0c7290fdd12efb557e7964d7ec3a517b67ac165
SHA256

26912bf6629ee4af0c6930c821096981b279246dd773c72a0eb92d79f7f0601f
SHA512

befdee09378151fff04b6149f966a39ffa98da80d54806ab1c6d85a3aec06687e55ae7c21b2cb522cb73c45ed0ec374b7b5c3da807df5ea5d2b159236e8f24fe
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiz9CQCh:V7Zf/FAxTWoJJ7TTQoQz9CQCh

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4646) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023ba7-2.dat	upx
behavioral2/files/0x0004000000022941-6.dat	upx
behavioral2/memory/4940-784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	c91658f0a08f73a863b30e9a93ef0000N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c91658f0a08f73a863b30e9a93ef0000N.exe

C:\Users\Admin\AppData\Local\Temp\c91658f0a08f73a863b30e9a93ef0000N.exe
"C:\Users\Admin\AppData\Local\Temp\c91658f0a08f73a863b30e9a93ef0000N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629364133-3182087385-364449604-1000\desktop.ini.tmp

Filesize
61KB

MD5
a538edf8cd667d8c2140e72e3fb6fdcc

SHA1
de988be4d984f72ae6fc7a65ab99c2f0782deee5

SHA256
6a00f124cb44e19f624beff9920ef5717dba03de433612d38d7ad00bb1e8453f

SHA512
3929967f228b9f502d2d80e812029951989ca60bc36317dc282183cdf21f4385ee51d80d7aa873174cefe2ed5d1ac7acc65c5e362b45e3ea1cd880e080024d61

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
48ff169694fc6a4898a7e67df19a0f09

SHA1
83de6ce9f9bcf4ebb8ca1cf74dabc81b91cbef99

SHA256
992741c36382fdeee7895238b3e7019313ab7d15362eb8ab8587b49cb8c53213

SHA512
5c9ea2b8131853953eab18f03344ff632995e2a88a2d6d798d0c0606eef7e3802ef095cf1d5e8d5adfb710ac89531561978bbe35877e42fbf89816d016b42100

Download Submit
memory/4940-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4940-784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download