5312e5596fcc1c1c168f4496f0c98879f812c52816fadb93672050fa60e10597

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d0ad11fb502657e2f897224a9dc7aa0N.exe
Size

57KB
MD5

0d0ad11fb502657e2f897224a9dc7aa0
SHA1

a01a86c96a1a4c4deeafb6385a893207fcf4483f
SHA256

5312e5596fcc1c1c168f4496f0c98879f812c52816fadb93672050fa60e10597
SHA512

27f9cc7ece05ad129f3461eb0cc0d2e2e5ebf777d2382477697b6b131faee5410f69034850bd10c24ffc5b43df309a3877476a35819c8be5386fdcdea49d0920
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8s:KQSop8i8s

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4348) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2740-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000700000002325a-2.dat	upx
behavioral2/files/0x0004000000022949-6.dat	upx
behavioral2/memory/2740-948-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\release.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationCore.resources.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	0d0ad11fb502657e2f897224a9dc7aa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d0ad11fb502657e2f897224a9dc7aa0N.exe

C:\Users\Admin\AppData\Local\Temp\0d0ad11fb502657e2f897224a9dc7aa0N.exe
"C:\Users\Admin\AppData\Local\Temp\0d0ad11fb502657e2f897224a9dc7aa0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
58KB

MD5
2a00417ebd8c545146239f0e7a39ca1d

SHA1
6e299eae4422f3564cfbebc075daf4a8061e58f9

SHA256
0ff18d66a18320068a84c7e8d708d22464726b71407643cc4c55eb49cf56e99a

SHA512
d7062c971586b81e0cb7356c96486c9502a3bfc208f46cb256f8c50bba90c8b9db45e93fe84ceca24c4d28db7789e35d6d1ebd3c4c907f627ba3e89cc736ba2e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
64935523926a8ccfc5f9b3cfc423b4b6

SHA1
0e8d5e59318ff44ed50666a8177e5d5b0461610b

SHA256
810be8cb2b266b56e681a2c9872aab00f25f5fd8d35d038628165e0ddd74d6ac

SHA512
0cf7a41a0a6c72c73fb09cd19a840ade76573cf279a5a93c0af308a2867a9d70643ac7489ff4ec12849f8727f79db8f447649423f1a54b5b80948441a0555050

Download Submit
memory/2740-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2740-948-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download