8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
Size

46KB
MD5

3b97c796759fac9dbe7b19611276707d
SHA1

09a9953a52f149c565ada8ec1015500384b4982f
SHA256

8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018
SHA512

28cefc9830e9bc561f313f0b0602526ecc6efa28f2d75a47866976a243ca9595cca33e94ea020ebf4e1c591ff8a5fc3cdec0e3443f7be9b61714f2319ca30c86
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJBZBZaOAOIB3jM2jMO/v:V7Zf/FAxTWoJJB7LD2I2IA

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023452-2.dat	upx
behavioral2/files/0x001400000002291a-6.dat	upx
behavioral2/memory/740-1678-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe

C:\Users\Admin\AppData\Local\Temp\8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe
"C:\Users\Admin\AppData\Local\Temp\8fde963fcbc530c73a51e20f91128b7237e44cca3dde1ac20ef0ff67365e9018.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
46KB

MD5
16c74c39f7154cb3d3b614d8704f234a

SHA1
982e4dd900d693f9aebae4bfbf7913b123d0c26c

SHA256
6a3a9585f4a8e830c4af9d03c3ccecd0d94703ae8f6361e2de39db9830d216f1

SHA512
049e7ea2186bd1334801ef2c67ac249406effa534798de9834a2aeb6885e993a413078bb4e06d954827cb242c1f1af5e4dc2662178ebd3547c10abd087db3fea

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
11ddc808314ad0715454f9e178c2be5b

SHA1
22a3d22a63eeef7b7c4772598a8096d100cd444b

SHA256
67ebb8609a5e20596ef427a12d7386a304c113f07f2038017f6a6fe1fe079146

SHA512
eeeb212a8b4b0c8dbf29ea4d88fb12d8d1f38155a187635d30d8b027c568319b8b6973f913b857352de3c9419b21ee295f52ffebd42b2c89e0140ce5909e93a1

Download Submit
memory/740-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/740-1678-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download