00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
Size

462KB
MD5

dee3a1c260afd49ee081194a4507f3e0
SHA1

ec08bcad031e80ce76add0b10568796d93dcc3a4
SHA256

00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1
SHA512

e5f9c26d507779b5506621b11276f3674382003f125c818f1deda8cbcd2aa41f5dada23b44a79d972a6e0f82d160ffd8310fd2a89ca717d527d74511c83f922a
SSDEEP

3072:fny1fBnRGYR5Npw90i//3wX4cuvfuxGs45Nc:KXUYRG043wX4cJGs4o

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2620) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3172-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233dc-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/3172-528-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Primitives.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe

C:\Users\Admin\AppData\Local\Temp\00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe
"C:\Users\Admin\AppData\Local\Temp\00ac41eb9b72a29db6588fc1e767f5d3c0f2efcd82ab59a00d42cab3c0c40dd1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
462KB

MD5
3e4630e6a056432803b039b2829218cd

SHA1
3426e97a5b5fb721068a774a667937e1a7b30fc2

SHA256
289a57c1f472298b79762c7c18d484b9e57b26f0c90db3bf2186d98322ec973a

SHA512
d212055f5f964baed241f8d05f88ea1446651bce87735befab3fc9c16050d1c77058eac265c363c2c58f82f511b071d2632525f07919761f219dfc2a24f69516

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
561KB

MD5
c968cfa2213f64258f5ceb5c21381156

SHA1
506bb919bc157ef58339b992ac2d10aafa3aaeb6

SHA256
57ed3296ba192f5f3041ed9d7fca6e138d1decabb7b0f0c923b7f86a8b6a8ba7

SHA512
10ffc451e025d091f6f3c2cca06a0514faab87736114cf39b4a8829157fedbb9f8bcfaac6315c3160a0d9cb4c7cf9608e83c89ea2c0345d3293ac0cf03d663c9

Download Submit
memory/3172-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3172-528-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download