a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
Size

44KB
MD5

cb1dc6c3a2e27a1e3bf9575f165d3c5d
SHA1

b5ee18e9a5c25c5831d40d3eba622fbe76717669
SHA256

a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726
SHA512

872649715c3921389d0091087bbe3931f896f02f66e45bb84ac99f62d7c656a82fe862615980fd6a6c47905905afdebd4d4cf157eaf31b5ca13ae8ded64d965f
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBoMAJxeMAJxZ:V7Zf/FAxTWoJJZENTBn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5060) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2352-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023463-2.dat	upx
behavioral2/files/0x001400000002292d-6.dat	upx
behavioral2/memory/2352-1888-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ml.pak.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationCore.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_200_percent.pak.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\MEIPreload\manifest.json.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe

C:\Users\Admin\AppData\Local\Temp\a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe
"C:\Users\Admin\AppData\Local\Temp\a7485cfdabb69a081a3b07048b563672c3d5dff18a83dd0eb6764bf1c6709726.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
44KB

MD5
769b4cf90ca652187c345e2558a2237f

SHA1
ec329c1e9ebd87bd01ff3058c555561897c1c3ac

SHA256
90f2bbebad9deebd64fbbac4cbba4ed247067559c6e95235d26bd888561fc9ab

SHA512
693fbe65d2976644501460e0bd7d87a52981f31908de3c1d8dc0fc0ef639aadd59942b762e55a96cca88e6919f10fba738733e784fc30ad8009128b3e46db3d2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
143KB

MD5
d6d1f224b1eadadc70153cce7efa02c6

SHA1
caff5a606cf5768e10a1d87eaf88163a4d85e29f

SHA256
0437972d6a4fc70787ec16f26ed0f9437a5dd52cf7fb5b0314f2fd9053b12dcc

SHA512
6e697c0adb6459b99d94b3e6f2c3ec0ece07e1027e39529392705a342983bd7de601d05fe78b1c6bd08fc3d45098d5c7e44ee6500736a62384c172bed58db518

Download Submit
memory/2352-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2352-1888-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download