40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97c

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
Size

80KB
MD5

7160e2721abf8568b2d9845c44035ae0
SHA1

5c8e6528fe2c485db1b2611095cf29da5612a77f
SHA256

40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97c
SHA512

0d8a5208d26d5349f0e8b2b5bf0d1f959e3f487e29a74c1b29183b88550819210f9eb2aabc3ea7bc895e3153ff65e32cc8b63a42f8e052e3abbac631426687ab
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8wYeHNm5EvDxfIyKoIWbsHfySkT5GeCyi348oWGT:KQSodYeHNmkDxfIyKoIWbsHfySkT5Ge1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4642) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2536-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233f2-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/2536-879-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Crashpad\metadata.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe

C:\Users\Admin\AppData\Local\Temp\40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe
"C:\Users\Admin\AppData\Local\Temp\40323b0f9b682a3605ff4c3a535b7b49d7586e181cce2ff7504c4479dd1dd97cN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
81KB

MD5
d9980c16d1ae69c87ba700f2c43d843a

SHA1
c696db98ed1c9e982ec5d7390017d9f6f726e0fe

SHA256
7994a915822d05f92d181ace55970a84808c384b0f18cfbe2fad3db98ba0469e

SHA512
bc1c98fbc65cc393af5bb9d4bf320fa250b764faee0e8ebd47a03c7bdc0422adb4f85a3644a5e0181c43fefb17417ca23e5cf5de07c54b26b28d907fc94880da

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
4e229adfbd688a23fd25cf3f68a7d227

SHA1
9ad2cd5b4cf6e43fddb9e314b7ca0cb189763e58

SHA256
1a685e19e8664c9ded79823150948f83f4217e8dc763b5a7df5a32598c0253be

SHA512
3140c8e75ea34616a89195587b79ef296356adc5ee0ca76421e8877510d40e8ee9d45ec5515126181ac9e088e5058d7276d8d9f9734b2dd34b4099088928d502

Download Submit
memory/2536-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2536-879-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download