158dff451b0b4b8ac38ab73a850ed4a2e87aa5e067e748f5f68161e56760ccb3

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e34d71b8c6078fe5241f7be14055fa0N.exe
Size

769KB
MD5

3e34d71b8c6078fe5241f7be14055fa0
SHA1

ebded81768a9aed558cc4f8502cd8f6ad7a62bee
SHA256

158dff451b0b4b8ac38ab73a850ed4a2e87aa5e067e748f5f68161e56760ccb3
SHA512

44ac9bba7cc0f05199d1c2dc71decce4a356c3ec4838769e054fda2e48856c7bca4eba40b549c477d5ac06cdd865b0c7467e35abd6ed1fa64c1580807ca88366
SSDEEP

3072:fnyiQSo7Zf2XtkZMGZqceyYDIqCdIwHSwO5l6:KiQSoV2dOPgc+16

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1973) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023437-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/5000-1054-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\AddUnregister.sql.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	3e34d71b8c6078fe5241f7be14055fa0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e34d71b8c6078fe5241f7be14055fa0N.exe

C:\Users\Admin\AppData\Local\Temp\3e34d71b8c6078fe5241f7be14055fa0N.exe
"C:\Users\Admin\AppData\Local\Temp\3e34d71b8c6078fe5241f7be14055fa0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
769KB

MD5
43703d4d8e7c8b97c7d1c5d2a946300c

SHA1
d1ec13828f3a35a6e524595977d516425a8feb75

SHA256
b4824820b3d44d8b74427c23a5c805f588fce3c5ed196498a7347f96b6ffb1e2

SHA512
ffacff0ef45228684e745ccbadaa97875dc65ce6b24fb2036efb2429c3ce24285bf85280dbd78fe4f01e2a0070790f87443141c7e0dfadd02f1b1235907d1299

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
868KB

MD5
a0946f2f3ba237bf3d9dc3e23895e143

SHA1
9399485c7581582340929591ae7956bfd961e48a

SHA256
53a7b43342c1cabe42c59da53931ba7ffda6d50a4ae3d06d510f33152ec84369

SHA512
806a2f3131ed0e23e9cc40743d79b60d6b540cb0b4bde3240fa980f3c8fbe078458ba98f0129f9ba855b3454f087410e1df10784849b14b5ba49a3a2f22b1a3f

Download Submit
memory/5000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5000-1054-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download