56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
Size

72KB
MD5

1835e95cab2f53969f9764fd23b40f40
SHA1

76dd1b36c0eb367fbec04b4dfe90a0a3048e03d3
SHA256

56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30
SHA512

6449e042c14277cf35db2507b499d6b988746695f2011d9f19142a454f6cdef0ad5a197bd10a14efce5b7f70b21dadc1ad82169f205c044e63b526e23deed0d4
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tism/:V7Zf/FAxTWoJJ7TTQoQsm/

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4534) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000236cb-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/2548-860-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fa.pak.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe

C:\Users\Admin\AppData\Local\Temp\56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe
"C:\Users\Admin\AppData\Local\Temp\56d1883aeb033e067053b150ad7ba0b300d74b719d0033939997a0ff225e4c30N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
72KB

MD5
894037c7107ce8b005de6c3121981461

SHA1
50c9009cab0e8cc2737433921e6bb3c719d30fb0

SHA256
ff8758294e6b27836b5a93834428427c4b22349963c83baed0bbffa532fed1e3

SHA512
8a4a7136d5e587c119482f4706a8d5fcd0e7c741159162f1d09a1dc6a196bd8842f5e6e9a7a0801093d551826c6a3e21f786054899efd14a0141e48b12f95be6

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
185KB

MD5
0d92e06a9685459b240f688091e6fe45

SHA1
0582b84a9209b44723561a3a5c3d6aa27458d8a1

SHA256
295984fe85dc8ee0689324d7adb3110d62b835980565cb77526989bc5c1044a4

SHA512
55ea2e0bb7ffb946f97989360c791add6fffeec56bfe15e5d604b773b0cbd17a4e5c8d73ca6f7ab8b9f035bc4352d1345540f4051ed57fc3a377f5ccc78d3a03

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2548-860-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download