1b07151ce740f7fa02a690e71a182e4066f9357409fd18d8689ea21f91fa2e03

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

58bfc053eea9768f44b0c78b8a4ba440N.exe
Size

51KB
MD5

58bfc053eea9768f44b0c78b8a4ba440
SHA1

c5a206ad98f8a27a62ba7ad5521beea85878e80f
SHA256

1b07151ce740f7fa02a690e71a182e4066f9357409fd18d8689ea21f91fa2e03
SHA512

9a6cce74f790bb4d88c663656906f26b6977a701abc306c42a8b7c0794b33ac330e052aa8c7501c2293e22754163cf804f9ae48f4a4b1ff355c260165f3332ad
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mNM:V7Zf/FAxTWoJJZENTNyl2Sm0mNTY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023427-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/4988-2016-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	58bfc053eea9768f44b0c78b8a4ba440N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58bfc053eea9768f44b0c78b8a4ba440N.exe

C:\Users\Admin\AppData\Local\Temp\58bfc053eea9768f44b0c78b8a4ba440N.exe
"C:\Users\Admin\AppData\Local\Temp\58bfc053eea9768f44b0c78b8a4ba440N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
51KB

MD5
d7d4a6a548061fb52e22ece78f842557

SHA1
1178979b9249f5275ab3cbdbfb534f1509dbb46f

SHA256
7cd4dcfa35b8af4aa71b81752c5f28e9fb3bef9e20d61edb2936884f1bb4723e

SHA512
8b6bc3dd990ea1eb1ad79ef14c73aaee64a5e2e1e9d2676f131836918b45a856638f6f0e651bc4e606aa4deb4847de6683b96bf973dd83e1934d7900bea317e5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
150KB

MD5
ed2f60d695dddd858fe1662edcd918fa

SHA1
6dbd788cfcc7cfc4f52a74b6a8fde22e8857b5b9

SHA256
b285f188a6579020442aea5127a1bafbe3fc3a6544dfcd773702a65a31c14d4b

SHA512
1ea0141e8011dcbd26495b5f36812c4b98ade0f5c48ea147d8c2abdaa6a5e57f9dabca23fea654c11f7d3942ae59d413598632ab7b35fbd0ce6591e7670be0c0

Download Submit
memory/4988-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4988-2016-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download