49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0d

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
Size

29KB
MD5

a0384fb599b696adeebc1c6aacd0aa00
SHA1

862146f30e9320b2a39a0ca61599af8fe4e4aaaa
SHA256

49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0d
SHA512

ecf586218aa57e23840c67d959fdf522d34529f6a99437d58ada4b9a1fcde2467c6fd1e91f7ec10d051eeda089226e2b0d409022e8c237ed68d51defa1ee3ebc
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9qQg3QL:kBT37CPKKdJJ1EXBwzEXBwdcMcI9x

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4228-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e5-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/4228-873-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-phn.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe

C:\Users\Admin\AppData\Local\Temp\49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe
"C:\Users\Admin\AppData\Local\Temp\49b3d81534bafe785061eaf1387edbf7d83e0507acf3318fe12930671f9fba0dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
29KB

MD5
da33aaf3d78d0ca9d83fbbea9364f9aa

SHA1
a3e8a2b880abebfd12555c195d60a7cf8d901bc6

SHA256
ea05df730b6238cd4d59ebb41b3a393ac624dd2e0b5ab54300209b7a57432e71

SHA512
dab8e21d30a38cac3434ba21f630e4e70ccdb1688b4ef9ea55dbc1683d351735b6b6ebf53db68f1882337113f065a80bae3e17261e61e21cdcacbbc84f55530f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
128KB

MD5
4682bebc9255d57023696f54e184955b

SHA1
f7358a07ba73b56374523480bf3c32af8a6d316d

SHA256
c66ce101ba914950bddd26eeb8597214dab6805c9ac554a532f5c47a4048a908

SHA512
673ad6778f9b60cd92c0fb7031a1d22356e843078ff8daceeb82abbe399dcbf78a3f7a8c4a262ce51ce214ac75274ff13eea769c6130af9dc1eae4e86059a03d

Download Submit
memory/4228-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4228-873-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download