c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
Size

53KB
MD5

8f518899e6b3df25a63905615c9fe59c
SHA1

ef8556b144861963f35f4bad2de85a4e8a938b90
SHA256

c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946
SHA512

429900d16a979f139c370c3fc98ef8f6b498e2729ceb774dc069a84647d337aadbd5f7ea07576ca3d9d8fc2be49146d14c0c6d69a8342c6ee0c8048a3d594656
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJBZBZaOAOIB3jM2jMHsLzwze:V7Zf/FAxTWoJJB7LD2I2IHsLMq

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4632-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023448-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/4632-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe

C:\Users\Admin\AppData\Local\Temp\c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe
"C:\Users\Admin\AppData\Local\Temp\c58efc6a19f930c5c865506be4dc6c70066bb09d6b0061fa69b08741c0532946.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
54KB

MD5
159dab40e8d6bd94786c13a7a6822f25

SHA1
cb3b8a5fad7c7c104d02450e08882a7e3f797bb7

SHA256
0e9ea73833f2e64c37994c926fd1703afc1bd546a15997fefa6fc5a5c876dc3f

SHA512
4683a568e73181ef1bc317602ab83db61450c7d9c8fc02760275dace769b2ffe7cb0e4fdfc6ef481a6735a97396c4ee5ff01a7ada942ea00731f52864f6426dc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
708802501a16dc08a2ce62a3ef6ad8ae

SHA1
a681ec69e4144d016590fa095688b153881d1d91

SHA256
0ddbb532c7545f89b6d26691f0bb969970f4d07e6b87c77ffed5587d18124fa6

SHA512
a7f59f22db2a17170b1d51244d1309c279edfbc6959094b6b6171e36528a4a239e3f8823848f4ada826b4be3518cb62ce967d6fac6b20eaef28c6cc07b94769f

Download Submit
memory/4632-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4632-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download