5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
Size

37KB
MD5

77eed6aabf1d0cc3b1fc7a70ae7d24c4
SHA1

197c35010e719f6f9dc2ec6add890302809375b5
SHA256

5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05
SHA512

65fd1dbdcb2d45a124ff197a101277f1eaaee5c0354d937c7afbc4af00e94e4dfc87de3c3c1bc456502f96ced5f376831d645126199a843aa70dea9ed8c9d43c
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeKja0u:CTWYja0timmjcVFjVPjc0ja0timmjcVe

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3948-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e0-2.dat	upx
behavioral2/files/0x0014000000022933-6.dat	upx
behavioral2/memory/3948-1114-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationUI.resources.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe

C:\Users\Admin\AppData\Local\Temp\5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe
"C:\Users\Admin\AppData\Local\Temp\5e4942c54938820e643c133bba4bd0028a3c4fe4137e2957a124203831496c05.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3089151618-2647890268-2710988337-1000\desktop.ini.tmp

Filesize
37KB

MD5
f8e2e8c6e5301fc85f1be73afd89b9d8

SHA1
6575378f0d5244258a4bd279765e7a70b1799f67

SHA256
54744dff3d8388d912035a6699b8fd200d7c6e7f33fb81ab5b632ca70ad217e3

SHA512
52127befc5509ddfd92b58d7738c840c403f46ea3c7171585519244673d6dd905223bc5a6a618f6af5db1e3490f7ce417ed234ecd45395210b294ec82ce29215

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
53bc23e60b67cf290459c0425a9bd2bb

SHA1
e536a624c3ef0e77b9a2f7d0103e682a4eae5c6b

SHA256
f607422985ae56ffa4ab72ffe135a4c1ec7f38f54e77e1a2b28e081227e8bdb2

SHA512
afc50cc3684a5138a3ef54ea618ae7fe32bca04897e798dce8dc0dcb89fc54e5b248e1ebfdc109de5f94ee8b12c4711b6e59b61b1285ef0309520c927265f8c9

Download Submit
memory/3948-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3948-1114-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download