14fb24628b6dc043bf7edf86f727f1224177ebe527d550b7d7d92b571ea8c578

Analysis

max time kernel
120s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8330a8e57fbab8792504eab3353e8780N.exe
Size

28KB
MD5

8330a8e57fbab8792504eab3353e8780
SHA1

a219458de9aa1e471f77a77d6fbcdb8102f4e31f
SHA256

14fb24628b6dc043bf7edf86f727f1224177ebe527d550b7d7d92b571ea8c578
SHA512

4e7158ea7bcb4f11e946ae97e579bfd0944f61988bc787519e562b16e831b84ddef86cafcff7e0cf7b77753ae7f6451b330a6cf38a486e3001c9a1a906e51e4c
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lAwWskdAvIMskdAvIs:kBT37CPKKdJJTU3U2lWAC

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3883) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4108-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023407-2.dat	upx
behavioral2/files/0x0014000000022932-6.dat	upx
behavioral2/memory/4108-850-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	8330a8e57fbab8792504eab3353e8780N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8330a8e57fbab8792504eab3353e8780N.exe

C:\Users\Admin\AppData\Local\Temp\8330a8e57fbab8792504eab3353e8780N.exe
"C:\Users\Admin\AppData\Local\Temp\8330a8e57fbab8792504eab3353e8780N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
28KB

MD5
e0309b09b173e55d9c5d62bd4a721ad6

SHA1
085f8981d5022a5203aebab6122b13eeae552d03

SHA256
0fe5f8abfec90ea139365d3a3103bb33f1a3a9b3583c38d8b11f99770fea6efd

SHA512
8248551a8131ff986f03c4396bcaaee8f367c804006958ce048044e2d12ee7a286dedc6da8a18de980d920fe9cc0b6053fa673d872163a786e900ded1233a527

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
127KB

MD5
28e01e1c3da51a13e21459d58ac6ad70

SHA1
194b49fade78d6683e8953d0fd8c7cb4310fec75

SHA256
733fe95186b93d76c53bf3b6a8ab982bf584f332cde7205003640958f0b05d7a

SHA512
58215258730ee47bd22c78459ba55bcd24a49419537285548f2f70573a8152ffcd0b7ab691b0fe3bd88834a51d7cfc0c05d12fdd8af1dada73cd0f27e06679c7

Download Submit
memory/4108-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4108-850-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download