bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
Size

58KB
MD5

251665e54886185bbd9bed5b643d0cd0
SHA1

702043f1221c44d4a61a9d1991a4ff413fa29322
SHA256

bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1
SHA512

215e73911580545b85629c31e46fdf6f5e7f269b570c11bb27d7109ca584d08e7f4de9cf3867bf95815fccf536cf050c8a7dc26eab5e9d90bff697f244f88803
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKF9AD/:a7ZyqaFAxTWbJJZENTNyoKIKM/

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4016-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002347f-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/4016-952-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\msipc.dll.mui.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOCR.DLL.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\CopyLock.contact.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe

C:\Users\Admin\AppData\Local\Temp\bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe
"C:\Users\Admin\AppData\Local\Temp\bd2b4664fd98e21574d09f427d1b86db67d6f566c8c9098340eb660d01c35bd1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
59KB

MD5
29749903fd76ac950c9554e3e10001f6

SHA1
1dde6a57f80c3e7c665383b59baeb6bfcd6d4cf0

SHA256
9655012681f5c987367f2c6bcf36a673f15d6d496d06a4cb836da3000ed0269e

SHA512
edd4570739312420c6ecac748441171346505182e994f5ed45a216ccaa5a6eb085a08c8faf84cd35fa34bcb1ac7d4446586e6665e44725647159e8465d642c85

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
3259fe097d564e462048072188ac470c

SHA1
5a7ae69c1e8b30e6dceb2af816ede47b7ab30741

SHA256
ddc0692fed0eed147f51dc810166dd610070d328fc8cb01c756643177ab63728

SHA512
7144bf3313995897e1eaf693eadcec95a0ad5f7e5ea6661a9e4f63eddbaa1002670c5358a7d94e220d539271db38611c51824b2945dc5c27bc7950b3eaadd854

Download Submit
memory/4016-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4016-952-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download