33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
Size

64KB
MD5

1fa0271d8d0cd56e470271f9420d56df
SHA1

402f1eb48a9a8b900e1425d6490ac7b34028ad41
SHA256

33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb
SHA512

ae85a4a6b580a750583dff8be914362913237e571deddf7ae1d6d913b5fa387529810d41c4a74a5d8dba092f2899684c4ccb93dfadfc3d0d322948120f3468dd
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZv2v+6y:KQSo7Zv2v0

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4688) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2688-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e7-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/2688-798-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\zh-TW.pak.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\vi.pak.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe

C:\Users\Admin\AppData\Local\Temp\33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe
"C:\Users\Admin\AppData\Local\Temp\33f8c75ed0eec5845f852d229b4075cb930d1154694c5f52c03fd914b9d7eddb.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
64KB

MD5
398e1d0022e7b5edef6d4b6eb9452c7c

SHA1
f51120b4455db6c23ea0c7fd02d2bf90c41ac85b

SHA256
e3aa7835c3771aad878943a9f5192d2d51f96e00b18cf767b981dc3dbbf099f9

SHA512
2d4d111f5aeaa9258031b5a3dc3fb9f12e1daad41be2928906d7d5c46cc91546cddcad6e102385c60baea51af9afebbe7b4150e9928bc9b7e5f261e4c241ff29

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
bd3ea586dccc8f5164d1de6dec330240

SHA1
b2f70aee38487b3bce9ec2eeda67de7291167ff8

SHA256
c3d5a75a630ff434da6457f5e8fe6d1b9008b20380f1c9c20ca4da95be93cac8

SHA512
aeaf4c6e800d54fba0cc65402985a81c1158a990c2305fb042331b47b47a3479efc00477c7e65ffd735d3a077c895b3deff3e39c69b12d912d0db42c3b0b133d

Download Submit
memory/2688-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2688-798-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download