6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
Size

26KB
MD5

1f0fdfde8f581e3ed831081ebb684a30
SHA1

da9cef30893811f7df8da847d352fc295e3f7a53
SHA256

6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1
SHA512

d8649d3e0a1e3c5b1b950d53dd4bca3b659c2330b450fe7ad3b3f3ceecfd72c0fd2c54355938c5f5cca07010d1fe7c67101c33ab44be404584ef8718ead841a0
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+95PFhlz:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Jlz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4664) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c000000023b1e-2.dat	upx
behavioral2/files/0x0004000000022902-6.dat	upx
behavioral2/memory/3404-791-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\CompressResume.mpa.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe

C:\Users\Admin\AppData\Local\Temp\6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe
"C:\Users\Admin\AppData\Local\Temp\6608ba846eb6f3f73296968f03494d1aa67dc576df07a55cd9c53cc8c99a23f1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

Filesize
26KB

MD5
064575c870b2013550f97a49b2782469

SHA1
280bc267ca70c47f9a1f914c97f384b5e184cbfd

SHA256
e47ecc4cd606bb57c0b21d495b800ee5f56d901c12862137bb8c9c58cbe35311

SHA512
1900876742ce172949c7627958e8a04f549fe0fdefb36105ed2ac96bdbf95b96da42f2b8b5043a054acc8ccd89d50f0038f1e76ed030d349cb3f2f92de6e7228

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
125KB

MD5
40ec4ca3fd54f8b3f6595aca66b7310c

SHA1
603eb1d22be97890b6f42e116f553e136fc431e7

SHA256
609261c280ab0a57ca21e96a5526baed244497fecbeaccf0a4067d149db7f6aa

SHA512
7abcdcb89519cf79f44e4d15fca7953d40c0f5cddebdbb8ed4f5b8593ae936ab2c7c472e5d8046656f9ec9da67b4a6e510371c1d3e5bdcc840f6d81bf7dec33c

Download Submit
memory/3404-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3404-791-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download