b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3c

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
Size

53KB
MD5

8b86c2a4e574351fc76dd3048902bb60
SHA1

51ef262bede951fa5290bb9d897a6d71eea1771d
SHA256

b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3c
SHA512

5ed35c5041afe3b35df453f8207b92be5ce21caae12e8a2f59aa565ea713e511c4fc274b69498b055f2db3e25c27e295ec29adc1f3ff122cbfe7149e9263f37a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eEC:V7Zf/FAxTWoJJ7TUB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4512) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002344b-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1640-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe

C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe
"C:\Users\Admin\AppData\Local\Temp\b83fb9be40be918997c966e05d73792569ac0963701faef0659d97e935977b3cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
53KB

MD5
4ea700c86157026fa3321b446311ed2c

SHA1
a1b12b3f871821c404bb0b24b9db7ec7898d2498

SHA256
52cd8af23a9f5e9b284451c60f3df6acd1834a657b14796ed5b8527ae3633558

SHA512
9907d54c0bc157902278d13fb8889d3be39a4f92b9e267201946d9a84c78bcca0ceaa6426515a2a50043ba1be0479685887604e3713ceb6e0b0b742ea1bebca9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
c1789ae15617ee9ebfb18eb22f4de4f9

SHA1
d066a378a681a56d495c1966359d8a50f92d01be

SHA256
27b7d977cd8eacc10b483cd5ead3f3a8f717c3dc5052cf6c7694bb4795c68ae0

SHA512
702180d1f9dbd50e6f5ad283a1c4f6788792eb2ec1cecce44523575d6219f65ba2fc6211570a492c46cbf53c73149d1c3f9bcd7be07a732d9dfaaba34e022f6a

Download Submit
memory/1640-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1640-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download