aedfa7068ba1d3856134f25073e740ed936528ed104917df024a478d8f348d17

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2324b90ba84d9ad44e441c9033d14ef0N.exe
Size

60KB
MD5

2324b90ba84d9ad44e441c9033d14ef0
SHA1

c4010cfcc79dec381fb5b010fd7da76a11a96ca5
SHA256

aedfa7068ba1d3856134f25073e740ed936528ed104917df024a478d8f348d17
SHA512

972076abb8c9f3f881067be90d0b2c4d8bec852536d4c18501f882c9a4c78766f5f6654a43c0ee2d2b83283fb0b7d4d862e7efa81f69d1d9aa3494932ad5404a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rq:V7Zf/FAxTWtnMdyGdyvsb

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3972-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233f5-2.dat	upx
behavioral2/files/0x000400000002291b-7.dat	upx
behavioral2/memory/3972-1970-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesstylish.dotx.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	2324b90ba84d9ad44e441c9033d14ef0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2324b90ba84d9ad44e441c9033d14ef0N.exe

C:\Users\Admin\AppData\Local\Temp\2324b90ba84d9ad44e441c9033d14ef0N.exe
"C:\Users\Admin\AppData\Local\Temp\2324b90ba84d9ad44e441c9033d14ef0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
60KB

MD5
6dddb9a2b057551475eeab4b5e10309c

SHA1
27511b97cfb9a9ea1b8f2c27291e147ec29f1f3b

SHA256
b6bca1598e9afb53ae3e0a91e6035662527697f59904e4b4e37df9c04f3a29af

SHA512
9b7a77638b07b82c6921b6c671859d4a09f4991d7a69862ae3fa1d4792122cc45b0d4ec7a2dd31b86fc851c9a431f4fd2f724a4518281e29e05deb72858e8f5f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
159KB

MD5
18d276e7270e276d03ba424938822375

SHA1
21809cbb6121d793cadf72f70f5f7407a9bee70b

SHA256
1a9a046738619dde5e45a62356736db6cee241c17b495871dddc5a0597dab2da

SHA512
87cc4c15dad9b3f34c9982060e87a18499738c63b64e1c60a653adf5c2b1ef309941597b88dba8a8018cb59a2057ac25942497a51fa62f8c0d976ae31c716142

Download Submit
memory/3972-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3972-1970-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download