6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
Size

329KB
MD5

b2bea2fd416b92e5172f0a3ecc624087
SHA1

0fefee63fd87e5e87e3a23d0e1f9d1acfb4ab20d
SHA256

6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c
SHA512

c527ce4fce6a099fb744a582329da6ac50886e115c2317745f7d5b33f1e2c35135d69204dd4e1695fdf06c070afd1fa316b2be27838122f3fcd99f04092664ba
SSDEEP

6144:KbEJIjNDv0bNXkbvL+EJIjNDv0bNXkbvLu:rIZGNXkbvLbIZGNXkbvLu

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023bad-2.dat	upx
behavioral2/files/0x0004000000022916-6.dat	upx
behavioral2/memory/4376-638-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Input.Manipulations.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hu.pak.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sv.pak.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe

C:\Users\Admin\AppData\Local\Temp\6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe
"C:\Users\Admin\AppData\Local\Temp\6a6131b1825798ee68bced3483463bab07c4eb4c36e38cac8daca52ce688442c.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
329KB

MD5
6ba33d1dda4f478ae8a934273346035e

SHA1
caf5cec0bd86801f6f3d076ad58310f5860f7d53

SHA256
e17618f2f7f3edfaf948546840f20c646b4bb5bbcfe8be27161da6332dce138a

SHA512
c7652b7abce6e557be4fde5a5c05846d361a243fc9c59cd8b7813fe0b84ed30941879555a90953dc57adffe96cf29acccc601e1c59d574819264ca3ae1b31dc1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
428KB

MD5
3714bc01746c41fb5430d135eecd8400

SHA1
209a4d2b515d392e6d37f148e97ccbe3a574a1a9

SHA256
c128d4ab6b29d4ec8a5124b699973df1382f17d0f54b86a8371d634d4bc6abea

SHA512
82925749bd3fb5b2af661637cae5b2459b1ca73b64a8a41365d2207e8cc4def280fd79266b3543d99c24626f2f79924d71f996620c7d19e196d859e79b075215

Download Submit
memory/4376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4376-638-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download