09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf

Analysis

max time kernel
150s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
Size

60KB
MD5

ba4286ec20454478919413252785a57d
SHA1

124daf2f0e976cc3a079968515f402b870d22579
SHA256

09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf
SHA512

70bba7e6837ab129b261c09a37e642fc6410b1235780b1bbc3f6ed8ccb98480e2c733328a48ea41cf641c5547bf5c1c607ddd1a0b5dfdb0586b36683056ca65a
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8+g9VyjVyP:KQSos

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5077) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1940-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233cf-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/1940-881-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Design.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TextConversionModule.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul.xrm-ms.tmp	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe

C:\Users\Admin\AppData\Local\Temp\09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe
"C:\Users\Admin\AppData\Local\Temp\09d091af8eb9a7228d8d75b3e26b859c327db52df2a18602cc92d995e1a25bdf.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
60KB

MD5
8e7563b5609eaa15fd257e30b9d29071

SHA1
28229ac3ec9f08d6b5ecf6bbea742aaf3cab6da6

SHA256
280f80f7503109033e4ebbf92e71c20e983e7b454816f700b8d5980d4ee00795

SHA512
0b2506e49a6592f10359cbfce0098f38831e7cf6a0cbc14b48427b552e67bad19c29334adb0fe2bde19431ef84372b998b68b19f916c9f872a42cf84eda5c8d7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
db8c57de1e903a681f6a5d0f1d1a3b3d

SHA1
82725c35909e346d3e154d00384d35975e230631

SHA256
6d3b82dda3b1e39a7026f3b20c0978c5c8973ba04f138e677341538d67779623

SHA512
0a99f993633286a7b284646e42a7956a660006ce45e8a0a9c22eaf3e55f4727d67a7d9df58353fd830ee30f96e2f1ba7ace576956f4c2cbbd01c75f16b0f13a6

Download Submit
memory/1940-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1940-881-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download