d3ebd8e58a5b6eb80692a2b3d9effb38bb6a977488811ec801cd71048b1e55a1

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a11dcab62083593c9c5ddbbf5f9aab0N.exe
Size

89KB
MD5

3a11dcab62083593c9c5ddbbf5f9aab0
SHA1

35ae75eb56faaa3113154976c458edb9ffc03d41
SHA256

d3ebd8e58a5b6eb80692a2b3d9effb38bb6a977488811ec801cd71048b1e55a1
SHA512

56b6267417660ef2e907a9413e82004b25df8622295b6058aac157cdd2b3684fdc5ef8ff98803283986d3247b7458535cd521839ae66a5d7e32cb7a52e37c318
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCJY5YHG6GH:enaypQSoskMY5YHG6GH

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1776-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002345f-2.dat	upx
behavioral2/files/0x000600000001e5db-6.dat	upx
behavioral2/memory/1776-1802-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\mr.pak.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\LICENSE.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	3a11dcab62083593c9c5ddbbf5f9aab0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3a11dcab62083593c9c5ddbbf5f9aab0N.exe

C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe
"C:\Users\Admin\AppData\Local\Temp\3a11dcab62083593c9c5ddbbf5f9aab0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
90KB

MD5
6eba9640c4bd95bcefb49c01394c3ae8

SHA1
5c7bedd0034fe8301f99030362f552eb268ea962

SHA256
4c32a5510b610e73af33bf0fa2079e03a6feadb726e48d0bedb21d9139a9f6ea

SHA512
5ccb152ee9a3ca712c43e738e21c6e28343f7d10477279d5aa913dd2334e1a4d6a7e7ea72ecb6eef755e4af4a0e896ab846a5e2cb0fec79e6cd5ea776c492b8a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
36044381480cffa502a2283766f63627

SHA1
0cf8012112382f21ffb53c68e30a0b6a4bc6dabf

SHA256
d999e6a751cf23b06910d2bebdd543394921a93a5555999e986583d530e9551c

SHA512
40b2f1ad89b1a059d7d085df8443671630ad5c4a11c7db88f4e84849eb037e702498e935c276bf7cda0f25fd99095732da77a2b15491a81b8bbc5e5b66d51c9c

Download Submit
memory/1776-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1776-1802-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download