b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 13:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
Size

1.1MB
MD5

833790d4fc106fecfc6bc3a20cb12f00
SHA1

f314a7c351fca192e82dd54ea811c2f48b4a642d
SHA256

b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90
SHA512

e8ed386de066e3f4e989d96da0083ecf68fef96c9eab175778cbbc0d6724257cca839e7c5ddae52c159e09b2f0151290d7747aa89f961c256c3bd7fb6d957533
SSDEEP

12288:HRxUzukXdE9qxj33vGPL5k4Omwh4UC1kCT9Y7tPMR:nUzukXdE9qxH4OPh4UC1kCT9u1K

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2298) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4460-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023cce-2.dat	upx
behavioral2/files/0x001400000002292e-6.dat	upx
behavioral2/memory/4460-392-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe

C:\Users\Admin\AppData\Local\Temp\b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe
"C:\Users\Admin\AppData\Local\Temp\b99871f9d319ca2300e4d65417e3522c36602d84c8e15496cb96ed1bbf9a7b90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.tmp

Filesize
1.1MB

MD5
5268b65963aa2c0d291f5eb44d8ddf30

SHA1
d4b9ef3a49a6c2e84505d014fc21dacdcb871623

SHA256
8245ceef760b906a261a09827c90bfabae90adf1b9d6f5ed59a32e1bf566ec69

SHA512
6f57d9a5de03854f401455744a2586b06b882e2ff022be28b275e79f32e5aa02eac84dcede042d75a660b8bb4906a03f81537fbe161445f6b87f07ed33668fa4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
1.2MB

MD5
a1a169962830a778d221b7a0039986a4

SHA1
1d6310a1f05af8287a59a3281e7958711f2b7123

SHA256
1872e82f625672e9622dd5ac09c3a273b51a0793bab05734babd62b96985b8c0

SHA512
b73dfd2d49c15885f85903547da407fc3da1a07fe90d4ad511e1c959372699d73db324c343cc5805b989141dd26b1bb8b7846729ee3abd00a3a37fc2dc858c24

Download Submit
memory/4460-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4460-392-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download