5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
Size

92KB
MD5

dc91659f7db241edfafdd371c4207ee5
SHA1

fc6f51eea2a86b70a76af5d53cb1332916bb4c90
SHA256

5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca
SHA512

66126f24e3eeb4cbfb58d90bae172b2d04ed8beb9248cdd055af0ec1cb2b147696dd59dab80f9c89c5e4221c536f7ecc8c0b2410f6684d5ea0d15b8a11e156b5
SSDEEP

1536:V7Zf/FAxTWoJJXjqM3M8RpDgnZcmFZb3sp/2:fny1beMc8qcmPDou

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4824) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4956-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002344c-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/4956-1750-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ro.pak.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe

C:\Users\Admin\AppData\Local\Temp\5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe
"C:\Users\Admin\AppData\Local\Temp\5310979df353968b41fc26ceaf37726d57d569acec57bfb2c927d17c0b47aeca.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
93KB

MD5
673ce860ce1bebb00efa72c4212a4b9e

SHA1
86fd4b865d536df9200972659c9a00a32c642542

SHA256
6aa66fee57ba85732cb0a189f99f137707d45fc0f13ac8834fb2b5b74a13ef0d

SHA512
7cf879edba0d3b4ac5d9e76e6574ddbff56773701051163e77c6bb3b49d35bc146469d930c4bf9ba6cd321b780279330ba188eb13d75a4580d75433e037ab2b7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
191KB

MD5
537abb2ccf6878720450046476005e83

SHA1
4842e8ef4cbc20faadf2d047692cc3f7e0e43337

SHA256
c0ab42e3eeb758787f1345f0fc2b4f24b879e63af2ef8ab4e4b449fc229ae5fd

SHA512
a14643c473304b9ad80e4d640ac834c88fca0247fcd36157f18e80105af9847624ab96d42e6c1d4b5b5c851323a7e821fa0ea8068be56b51c4ea5d5480d25b99

Download Submit
memory/4956-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4956-1750-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download