3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
Size

57KB
MD5

04d5fe5d30b33db9a234754f124f3df7
SHA1

93f66cc3a3a09ca6a63c3467528658f3a46856e8
SHA256

3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a
SHA512

427bebb0be437a389e410a060eaf364387406beb3f5082d34f720dc8f263b5a5382338913a41c7704af8ef9fb2f2a4ff16e4a1548015468d30de2b9d57921461
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFza:CTWn1++PJHJXA/OsIZfzc3/Q8zxY59

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5046) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5036-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023404-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/5036-1108-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClient.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe

C:\Users\Admin\AppData\Local\Temp\3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe
"C:\Users\Admin\AppData\Local\Temp\3ed721f0879ed71f215e8ddda24b855d5fb909478477c81577bc50e69755e25a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
57KB

MD5
25fdf782cfaeace4ba9e5eab4081c1a2

SHA1
0a33cb32b7e2c1b9d5b9a7eac4cd520a7d0b837d

SHA256
53a37573ca603429fc601efa1b97d4227698606f7bd29284029228a8a8e9a76d

SHA512
060271007ddcb3211f2f687fdbe51422b48df2ed869623382e308a57945da14206aa402a4ae4795a332894e62915c35dd157e03debd938500e2c0dc28671fffe

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
e2398254fe6115fcbe1a60df1684d9e3

SHA1
45786d2beeff1d7724604d33d90a4bce316cdab4

SHA256
7daefdc71185a69c6f1f305692406a4387bbefee3c10a10ef9b82443b212b5ad

SHA512
9a185e7d26f99c93816c0462e4d09616b0075f243b2439172fa2ed466509dd2a178aac398e9ff0b9e5e7d652754bad6ccada0f85dbf4d8a569f8cb55414054b4

Download Submit
memory/5036-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5036-1108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download