70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0f

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
Size

55KB
MD5

48237518bda77ef9378df5dd61dccdb0
SHA1

1775b4d1337df652441f4a4600ae76ac44a73310
SHA256

70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0f
SHA512

8bd968b07f928cac12e070ef005acc17b18c5c7110c317000359cdd3dda657f5bfb3766a74a17670fdf9823318a798bdac1dfa251ac14b90b1db7b81490a4fa3
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJY8m:V7Zf/FAxTWoJJ7TPUr8m

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5240) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002345e-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3696-1012-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAI.TTF.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe

C:\Users\Admin\AppData\Local\Temp\70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe
"C:\Users\Admin\AppData\Local\Temp\70b76883854f230df9f7847e051819412f1604e4e41d62907183d6c89ea15a0fN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
55KB

MD5
dfba8bdd1574a03c5e2c2d82359da209

SHA1
efc044bf29b78e20ffeb4cead5c37411f4ee6cab

SHA256
1e88a4e5862afd28165185557efa2ed1a0f5e5430b335d742aea3788bb2489ce

SHA512
cfd2c0bf366bb188493b1ee18bdcdad1e5c16ac51f7d6e9d001ba51895be4a08c3c5957dea12f6e65c39b6d5b2d9df1af51a69d52c901cd6ff2bbd5a6a67fa4a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
62669a56bdcf50a8f7076937dd45e518

SHA1
43d0ccbf8f5984b2700b8078db6fa01dd6041934

SHA256
4241391e92eae25be2c113dd7278113f1246ee92487757c1126681d2d3add2d5

SHA512
6bb3863d03266e4cc259a1c7b273503783ca8ed855b114ecf6ba1f759b5c32a6d6cfef2c17b1bcb37a3cd634654b3e94f702af42274c53ac6a53478cefe6971d

Download Submit
memory/3696-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3696-1012-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download