7bd0c39e8d19fa5fdf75707e61b7d1ea0d189648fff66e1888507cf0c361e28e

Analysis

max time kernel
119s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e1d94878f4a459a8d537d922a0c42a0N.exe
Size

50KB
MD5

3e1d94878f4a459a8d537d922a0c42a0
SHA1

ccb905c9d5a6acab7ab7f9b37299b60282913a3b
SHA256

7bd0c39e8d19fa5fdf75707e61b7d1ea0d189648fff66e1888507cf0c361e28e
SHA512

3b982f7ef0cd1e6d72f7d3683f41ce6b26b9e2c680ad896f82263595ab0830bfa9250591cdaa0c8c9a9057e0540a848b94540dcad00e3b54a887ed677a13a0f6
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyIHAJvHAJLMF7:V7Zf/FAxTWoJJZENTNy37

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3680-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002345d-2.dat	upx
behavioral2/files/0x000600000001e5db-6.dat	upx
behavioral2/memory/3680-1786-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ko.pak.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\AssertDebug.xls.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sk.pak.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	3e1d94878f4a459a8d537d922a0c42a0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e1d94878f4a459a8d537d922a0c42a0N.exe

C:\Users\Admin\AppData\Local\Temp\3e1d94878f4a459a8d537d922a0c42a0N.exe
"C:\Users\Admin\AppData\Local\Temp\3e1d94878f4a459a8d537d922a0c42a0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
50KB

MD5
ce1bd8d0b38793620a6026cf8e22c948

SHA1
88eb8f5a4ffffc7a291bb8dcdd42f8802df68b53

SHA256
0cc586fb9316e2cff1de52a5337a5f19040a1322f8d77b5aa1c8cc4e1c25b863

SHA512
db5a050c6f170f06da32af5913f5246391ee3fbb7632a385b59fc46d2274e4b71412b4d805fa37271860888d4163a673281dfe540e4a325159e505d0c5c2a70d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
7d8f4ce927b73db4d3747d3f65c52517

SHA1
512ba7399653839a8eea5264e65b05150eb217f1

SHA256
bf7d8983007b86b607ef187f2db55c379a51cdd048c3a968cdf60b62fe4a7f37

SHA512
63961207ee09f98500f409074500915b9658ea34d84f8d04c3fb99e4201188a86189e4e5ee4f41a54c297503b499130bb92af3cda8742322970d804574f48815

Download Submit
memory/3680-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3680-1786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download