b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
Size

60KB
MD5

a99475cfc534b0a3a8407d929be94a00
SHA1

2968c07ce529ebe195dae21d381dfdba6bb5eef7
SHA256

b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26
SHA512

8bcba53622ece2af910f9025bb9f87ef0b386ad3ab0498235bfbb5977038b218f7f3bce250aae5a964d675d897c23a99450b47542aefac7dd21a2b826a690c7d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rU:V7Zf/FAxTWbiG1i

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347b-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/5112-924-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe

C:\Users\Admin\AppData\Local\Temp\b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe
"C:\Users\Admin\AppData\Local\Temp\b153e11c87374a855052729167ada1c2f128aa74c7498b9143b17a12c059af26N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
60KB

MD5
84678395348e9757add65eed9d6de76d

SHA1
85eb8dec04a4db33e5e978b3529ea658354dccd6

SHA256
453187380e1cb250425bc6909ac7823ab8c6db969b9bfe68ee54fbc128df6ce0

SHA512
6e1da1457896027f194275ed2daa7b6aca1acca4782d3ca7dc55f9f73785900ff26c656ede6af2aaadbc70b45a9af66ff4de4dced2fb1d9a23fcb5a9e43d0ce3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
2930423b1312fd5d2da50ebf76593474

SHA1
e6b88ef596e0f94c290a0e35408431b42ca54c38

SHA256
df3bb1182dd2af5102457e7f3a574b2e7615c2e828f57e0110e349c5e4ce6993

SHA512
0776895dcf1c7f326af7cd607c8b6ee62fcc088203cf26dbd7521ede7151607e5b9922bfed907912d422f83057b30d212d3aed93e965678af7760296fe164988

Download Submit
memory/5112-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5112-924-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download