b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7

Analysis

max time kernel
150s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
Size

85KB
MD5

dd9fba896eae7e9389c1d67e6e04be4e
SHA1

fc277e744cb4ac2013a9406576a4a3a0c94b7ffb
SHA256

b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7
SHA512

9f1922c395b7a5d54b6ac2d5d332db9579f89e98077ff19ae87d45acef9d46514691af3fd89b7867031073397ca58693325d6215db0604e997fad6c6f2731842
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5eYAWcG:fnyiQSox5Z

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/804-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b21-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/804-784-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\DESIGNER.ONE.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPT_WHATSNEW.XML.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe

C:\Users\Admin\AppData\Local\Temp\b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe
"C:\Users\Admin\AppData\Local\Temp\b1b57b2c7cd12798849ddc8b8d0292de9b67c5f29a6cd82ece9bc57046c04ba7.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

Filesize
86KB

MD5
1a9278649beb40aba1df8d2bf0388d32

SHA1
19da6f3d5c4eff2e679feb163166f9caf47e8efe

SHA256
5df9e146260963885e64b1e7276955783cac24d7e7dee469589d0eda451d797d

SHA512
0ae2369f02206737188873e5c56266668e64cf0c776829a52498403f76032e8b705c18c966a1e23396a1809846d9d2739c6d3671405d2709c892467cd0df8c16

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
752a963ba2f2a0a6db854bbcc12dee1a

SHA1
fdee15a5f5345841890b9324242dec823e57a931

SHA256
0a2e7c5949f567cd2cedf746716643f525f9d37270b79d44c6f66d41fde84484

SHA512
e686fe05eae4cd0f308f2c9666a4fff9dc447613972337d5e657c37891052485aff77e0b3a5a34759afbcda57ad047931577d0a45024465b7dfc6faec6a0299b

Download Submit
memory/804-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/804-784-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download