a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501

Analysis

max time kernel
150s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
Size

69KB
MD5

a16bf2b7e0c083d078c3580ba7ac0eb2
SHA1

84f31f1cdf7ba83b508ac32ca314a1905bdf5fcf
SHA256

a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501
SHA512

6c75a19597ef2aaf98cad8386ce50ea3392c95efebb9cf32dfd19b16f4f32774a8968dfb9845d51ea605bc910bdf735a83a42cf226e417b494436d11e8e9936a
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rQ:V7Zf/FAxTWtnMdyGdy1Yv

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4864) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000b0000000234a4-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2916-1912-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as80.xsl.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe

C:\Users\Admin\AppData\Local\Temp\a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe
"C:\Users\Admin\AppData\Local\Temp\a68a2b1f43e5019282e465294614433c78a1aa9244f460765c40b83a5f7de501.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
69KB

MD5
81d0b40cb80b02975a3203f6b42b2e9a

SHA1
6ee5045ae2e9c9a98876ce499795b02863f521d6

SHA256
33aac685b58d6be6982bb31fcf15fed1fec4d0c7abf2d211a5e47e99a01eadfa

SHA512
8238656cc3e385440102b699cff3d702ecb9ee9cb8658f9c931fad638cdf73a8a667a83998867751e62b9623a96c1dba4461c70c8aa2cf69cbaf9476aa2e1fa6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
a7e62ed688580fd61df284ba6b55d4f7

SHA1
84d8007cf13fc128b63eb784284fcec76ee56d0d

SHA256
1fcbbaed4ae861c733eeac8d849f3588c49373b391cbcd3145daa48688d8becb

SHA512
373c0f368ddd305caa1f3366b84fd9c32fd328b5ea1278d092a91345ec855e11d506f88cd8bb2da3f79ffcb88243efddddb549184dd0cd34012d58e5ec20cdef

Download Submit
memory/2916-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2916-1912-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download