6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3e

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
Size

39KB
MD5

c92ed24fd9f4350124b5df051a0fc230
SHA1

4f378ca21941e51e039358cfc43a729a84ada042
SHA256

6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3e
SHA512

0175f01e67eaa8a4a970ec2e1e3109df9254e1a994fa4ac63e0d70211d7f9264f44f1abb43cc0ec923cca3baaadc26ed991c51794503df7cd62bf2e14079899b
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Hx3R9pi1xOR9pi1xnJKGJK9:CTW7JJ7Th9ko9k7JKGJK9

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4697) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4240-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002345e-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/4240-1005-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Primitives.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe

C:\Users\Admin\AppData\Local\Temp\6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe
"C:\Users\Admin\AppData\Local\Temp\6e3d6c6c384535a9efd6757a31833c493ade79525e6433d8709bfb454361ef3eN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
40KB

MD5
efc33608a30d1731cd63743f6989cee0

SHA1
5de49347f11cc7da96527fe47e200e6c2bfda254

SHA256
9453efadd710a47b844f038a523bd0803d5449f10fe66fadb7ecb05cb616ce5b

SHA512
b6b1f54add02a7f78e11a32901496dec715277b6476b0ff0cbebe6376734c37c59dde094fc698b2d26190e31a5e60f57d164ca2320b3358a867d7bed641f6845

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
d5aafd1803b5e1f047855694b2d3770c

SHA1
f6d373e4ac6f70b0de1dbc137ece770d16ab8856

SHA256
1ddd482e2020dbf00252f24f9b20fbaf5258e9534a99affe88c230aaa10a48cb

SHA512
a208b8244bbc95b42c3a93bf87fc373854622981478eb06c0c290b569c277f80e3e0d7606efb382a4d9c7b4004f7d11eb02faae8ee5e26a104de6200de4498ed

Download Submit
memory/4240-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4240-1005-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download