6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821b

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
Size

50KB
MD5

cd70afd97cea096712f8937b02d41750
SHA1

9b5ad9d732b9150cf4f7f21f16cede56a444806b
SHA256

6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821b
SHA512

7f88dcf4f5ad3a4bddacd3306147da754f4f57bbe663ac50bc96b22eccae03f5ffe476fe918a99ff595f09fd785283ef2f61a8670fe424d76f845fc9ed90361b
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9B88:V7Zf/FAxTWoJJ7T3

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (334) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x0009000000012266-2.dat	upx
behavioral1/files/0x0002000000010420-6.dat	upx
behavioral1/memory/2548-20-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_left.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm.tmp	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe

C:\Users\Admin\AppData\Local\Temp\6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe
"C:\Users\Admin\AppData\Local\Temp\6179d05dd169da170b9e9dc20ce7fdaedd2331c9bd48cbfc01e91d429dcc821bN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
51KB

MD5
248aceb330362cd37026653f0efc4f4c

SHA1
e24cefa36ea896e168317c681e66919419b3e3fa

SHA256
a69006c1142e559b96e421e6482b12b4107630cff0c9436a3a9616d8b49a5616

SHA512
2572aaa307c258877bd0c4603d0e7c5676c38e520c276b8acd8afbd99d826be27beae7702bbf93d82153d985a3eeb0df9725ae4709b65ddf45b14fdad2dcbfb9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
59KB

MD5
635c042868805ee198450f078048801a

SHA1
847d59ccd814463c882dbbd6db8f35c439e02850

SHA256
9956b435dfc59328efae03057a6723558d36179723227ef559b1c10a0ad051a2

SHA512
0ad67f40d62488f0ac66837a8d89fd9f91c4aecae32b69e15031921900e8f702b61a552525c79e1569711dfebf43f3e6d749218d6c43c8bbeaaa025957ce2027

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2548-20-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download