78a3728acaee97ea503f9ecaf77b49c077c6f8a6a64c5b8f38e32e6230bdb07e

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aa0d07800ee4306b1647da5f2c72640N.exe
Size

80KB
MD5

0aa0d07800ee4306b1647da5f2c72640
SHA1

80eabfe6b4f52b97318be9f72af53e65a2de65a6
SHA256

78a3728acaee97ea503f9ecaf77b49c077c6f8a6a64c5b8f38e32e6230bdb07e
SHA512

b873db5d41aa87a285b8c718e2e9d5b53bd486283583c7837dcfdf9b5e9b8007068ef9b27f1fff0ead033ab709c01230267b8733937042be1c73bbc9c677cb0c
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZR9TZi9TZ2:fnyiQSo7ZTZcZ2

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4578) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/664-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023448-2.dat	upx
behavioral2/files/0x00040000000228f4-7.dat	upx
behavioral2/memory/664-1794-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	0aa0d07800ee4306b1647da5f2c72640N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0aa0d07800ee4306b1647da5f2c72640N.exe

C:\Users\Admin\AppData\Local\Temp\0aa0d07800ee4306b1647da5f2c72640N.exe
"C:\Users\Admin\AppData\Local\Temp\0aa0d07800ee4306b1647da5f2c72640N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
80KB

MD5
813239c47022f7491efdb13a7a5cbdac

SHA1
6e88f9f8f8b17fcf79db9e8342404ee789abb90e

SHA256
8ca9125849b2e0d2321384506ad2a2d221d0f3283fcf70bf7bca03e07b479909

SHA512
a96020191539f8b811d8bb5d4b2f42eed333835e380ef1f215ad0f3ae6c9da129c9ed1ea899fbe72ac0d051c39a269133c32982d24a76aa141299c9d0b751fca

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
179KB

MD5
12f2949c1a2068b86e5c8fd68a1f9824

SHA1
1d820fb0752e405e6e94d7dcda6925625c47a4ae

SHA256
ec152fbb7ff2e16d68032f8cb6037857256b27462f8edca5e0c9e478b467d34f

SHA512
b69aa02afbac1b503a438b117598c6f533f9a48e59a29b24be29f84b502b8b2f809e7d20b7923e6314bb9b12e67e89e46af1effc372eab9ff4dc808eeb2e5db6

Download Submit
memory/664-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/664-1794-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download