156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
Size

23KB
MD5

fc9d2ee230357323970aaec2f8edb0d0
SHA1

fb1847c421d0a4bfcfae1a3a342da61d03afb3eb
SHA256

156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66
SHA512

e468c5e1060e099312622e04fafe1c235db7508d76005eb163247d2dd5292c4075cd969da94e33dc35916c44162b361fb306596615575297c8562668ed75a518
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9Wqym:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Em

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4716) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002347b-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/1668-1022-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe

C:\Users\Admin\AppData\Local\Temp\156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe
"C:\Users\Admin\AppData\Local\Temp\156dc9e834d172171d008677ff124d4048bb09e5eaa5d275b7f4049eb033aa66N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
24KB

MD5
0bb73e4ce6e6140786f82e5dda21a741

SHA1
4f358375a3e2b537f8b652327e468c93039741bb

SHA256
4bbe1c6385ee7312b8b501689c6e36e3b230ed7ae31bc24a82baf713ed462204

SHA512
13c72905489ddc7cd8d4da360c36e71808828d44289e3e62e58b60051d6d33d28d972669bc402e53658dbeffd0edad97389b9ea99f430297f96a358c69447039

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
122KB

MD5
db580f861dc3cd8932f0f71d65c8f543

SHA1
233791fecd170f3950607e177e4c7b758f0eb13b

SHA256
8583f51f0d3864ffdcfd69dbf95eb8c36aa5becdb8497657265409de19d0e6b1

SHA512
72d6ce2c10af6968f7cea30e07b344c7ead150cb1cd1c9ba106c104139618fbc870a697b490e5351a11cd4af7b8e5060c158a8dd0447d2a24b91e4483b486717

Download Submit
memory/1668-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-1022-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download