40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
Size

62KB
MD5

c72f32078c5f064f491a66614f01f1c0
SHA1

91ac450f835b162c9d5acf4f7d57facbe61c7593
SHA256

40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3
SHA512

0521007872b5ab284ac503f714830e4e945968bb80e0325ada8c60ff1c7cbe0c56223c3bcb36ea40b8635685bcf5ebcfffc6aa9ccac87d20a879eb599f6cd74d
SSDEEP

1536:V7Zf/FAxTWoJJZENTBAOIfmKJfmKMTNT9:fny1tE7

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3144-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002346f-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/3144-914-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe

C:\Users\Admin\AppData\Local\Temp\40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe
"C:\Users\Admin\AppData\Local\Temp\40f43363b314535479d5e7accb80d1daa364de7370f4d23e108b8346450e40c3N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
62KB

MD5
e0f138864c2f05ff3306b3d7404310cb

SHA1
778e8bbffed5b818d862b8e03d899b03b397adcb

SHA256
7b99028635eb353663ae6807a8e8053fdaa4f9c31b4924072de8d86ca013c2d3

SHA512
6e7f717758967ebe2f92c056e6fecfa80edfc76ca9bd0c10b883d92b1742dcac787ee9b4dcc502419a51e4a2b76bb2bdf566a8817b808c30afb2f014ddb20d3c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
340d5f6f058322b2fae9e9dd6013207b

SHA1
66c54eef7fa074707886d377b807c5a092c75278

SHA256
9840b25fac26127413b1771e0b27c04853e69ff4c6d4983c7b56f30d2a8c3ee4

SHA512
bc14a39ce71d6adabc959e9dff38f618071b40262b57d71abfae69ba2bcfac5ed5b2b1c80fc9b0d3712ba698f237817f6b0b9b0f0a9cbd0d8d7f584d7708cb52

Download Submit
memory/3144-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3144-914-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download