14adb098236e0fb6fda030a451937296f8a64997021dcb68eb03ee6f1496e1ee

Analysis

max time kernel
119s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee323817db18eebc776883f2532dcbd0N.exe
Size

70KB
MD5

ee323817db18eebc776883f2532dcbd0
SHA1

dd6285510ccf9be2e3c37f10ad09e1e1a6ad349a
SHA256

14adb098236e0fb6fda030a451937296f8a64997021dcb68eb03ee6f1496e1ee
SHA512

3e95ee4e53c87f0d2e070c4de3888a5dcd17afbf349b3599a4d40a26e857d11138a2249a5b3d384db927136efb30640b35468011d7f0a2f20f16c77cb62b0f3b
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8Q8/8fCm:enaypQSoskx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4616) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3348-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a0000000233fa-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/3348-848-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	ee323817db18eebc776883f2532dcbd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ee323817db18eebc776883f2532dcbd0N.exe

C:\Users\Admin\AppData\Local\Temp\ee323817db18eebc776883f2532dcbd0N.exe
"C:\Users\Admin\AppData\Local\Temp\ee323817db18eebc776883f2532dcbd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
71KB

MD5
fe2272311448c232b65895000dec06f8

SHA1
82827760c12fbba4674e6d93e44c469598d1f009

SHA256
2ebb5f16810084d11b1a6b8deda8ae5a87ac69d3f9f4f2c0695c7ae7d0bb987b

SHA512
2b0d1ed7391dd9333e10dd99e1e81348b8b7ccf06ff009a1df00f21bbe0f51b0e3b0af0249ff321481e68560db7754d5487086d9d0ed7357f0cc6087ac1c9fb3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
d028a5bedd8d38d3766e709adedf9920

SHA1
bd07ef6055cef5922fc7410aa1fb20c2951d9369

SHA256
7957099928aaa00c36eb863988c6d9004538954b7337dd6752332dd8a034de64

SHA512
63f1b8017b11641e23631064dd0b6287559a8627f3e2b6831a63c6fabe89a6b82783f3a724c4f804ff92f6b30798e43cbf4175cfc0de3abe1ffc8ff18b44e980

Download Submit
memory/3348-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3348-848-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download