6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
Size

94KB
MD5

87982f67d48731009d4b94015eaba170
SHA1

19e7e7941b42ebb999f48c46a13efcb777d8c79e
SHA256

6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0
SHA512

b53793a389b2bbcb21fdeaca04b1e3a08fcbf61a87ebf78c48186fa1072d27952ae4bd0fef9acbc189e5cb42fd556add6f0aec70dd5fa7d6b94b149057a3692a
SSDEEP

1536:V7Zf/FAxTWoJJ7TTQoQfTW7JJ7TTQoQlo:fny1oRooRS

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2352-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000234dd-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/2352-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ko.pak.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Primitives.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.ILGeneration.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe

C:\Users\Admin\AppData\Local\Temp\6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe
"C:\Users\Admin\AppData\Local\Temp\6941a9a55574c5f209689028c008d4c8a49de8c9a62a4df3004582c222a8e6f0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
94KB

MD5
2733e10136ce6746bb149a71675bd115

SHA1
c275785ee99dcdc21057e470bb4e4ebaf6de41cd

SHA256
f2ce6322cb07ffaf0bfeb0cb31d7429491c618d07836c300205a796241c2d51a

SHA512
8a5ae5bdc77449744d4ad8845ceadb90a6599cb09ce1f108239c5216c78a58e2be669a6408bcce2089ce9e999d76502032ecf33187b448de3a93ba4b19ef6a00

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
77f15d950d885c8fed84fa1e23cee801

SHA1
301c238f91e8d3961a202f78058a9a23973aa757

SHA256
dcc678660733843805acad2611ed2f9d9d0b634b8ff9e61675ae21230e840b62

SHA512
4cb68dceacd6c2955a6a428c5a43a586d43e2fd167a189113996d7ad161226f7de45b2026ffb7717fe8a4e8c8b00c1b4daeb867c7d9efba571788f701b78f547

Download Submit
memory/2352-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2352-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download