223a86241b6d9215f5515e0302d1a691a8c1c4d7d5480de336c2285dfdbe8698

Analysis

max time kernel
119s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa331774632f19d59631e7b264cc2ad0N.exe
Size

53KB
MD5

aa331774632f19d59631e7b264cc2ad0
SHA1

5d9cef095f60f123067ba26a1963e1d3f105db0f
SHA256

223a86241b6d9215f5515e0302d1a691a8c1c4d7d5480de336c2285dfdbe8698
SHA512

ee425c0887557fd2f8db03227628475041c181bebb7520677cb8938310f71f37b1a674312a84b28c8c54824a82efb8073a4614a521b704d77e2c7a5be162347e
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIu:CTWn1++PJHJXA/OsIZfzc3/Q8IZT8

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3472-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023479-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/3472-1124-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	aa331774632f19d59631e7b264cc2ad0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa331774632f19d59631e7b264cc2ad0N.exe

C:\Users\Admin\AppData\Local\Temp\aa331774632f19d59631e7b264cc2ad0N.exe
"C:\Users\Admin\AppData\Local\Temp\aa331774632f19d59631e7b264cc2ad0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
53KB

MD5
2bab4b53ef480c738a871ba15abf2787

SHA1
daab4bc3d3dd39bf2b1d2b1c144ce54973ab4502

SHA256
ba4d1f1cfa93615807c90d48b55ad2e7150f74e8190f5db9819e7b477345f8f2

SHA512
2b434a57e81fad9e274a7b67d0b821cf0bb3b298ee3322ddfac75be70fcefa8f5e4634c5841c9c25498b4b2d35d30a0792453b9f2c0a10aa7a3c4cf090d88e11

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
1a0b9f421e8c571331f59b32ba70c5b4

SHA1
7ee9220429bf16c18c55bcf980bc4a20afea5355

SHA256
a02855b57b49b80abbb4757db7c1ca5c4d733f8a585738d11b0b1390d5180d11

SHA512
f41e43b0f106d57785a0f42214d25599be6d61b408987381b9123dd8f81e7f49433b4a5d05bc7d68d058dacba8eb1c95fa610fedd3ab882583bfaae3fb19ece3

Download Submit
memory/3472-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3472-1124-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download