30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
Size

53KB
MD5

9085431cdad718cae63baa9bd9b99c15
SHA1

9b03902912865bbe345f9b390db3c163679e51c6
SHA256

30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959
SHA512

7e5cd4ed7c9b576685b061536c3ec15bff87fc8a44d381a902a3117f30b6cc9b97f3be4a2433ac060023a2ac943721ca29a35ac4b6a974a850640e90928d649e
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0mdN:V7Zf/FAxTWoJJZENTNyl2Sm0mT

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3332-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023429-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/3332-932-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARAIT.TTF.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe

C:\Users\Admin\AppData\Local\Temp\30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe
"C:\Users\Admin\AppData\Local\Temp\30537fada046bbde50c2660d2d25d87c35b59d7f6bc596bf4bff1a4503dec959.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
54KB

MD5
d7312d031966221ac1aa1bd395249b20

SHA1
8e4a1978ad6cc44914be06df61179e7378b28d3b

SHA256
999b7d4f6ff2ab84e8f732f970f7ac5469c849aae8a6977eb8e04cbd704bae4c

SHA512
f3326b84b534dd9302fc59419e55631502dfbab0a9a18060f516caf8d158345b07ec8ff6dd0b019fb0ed93d8dc8f34c654b3d5c863de320710dc155a17ec72b1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
8d303d0330b9d6106f60a47d59c94ead

SHA1
cabd2b452d36d229b31592ce4308f09b9d271a37

SHA256
a43de8d52b757bda8a1d1adedde8abc4705f78e119e1007110f4e2a8149b901c

SHA512
732581a8750ab28ca26bbfd534a23a7ae04002ae853fe28cb8c9cfdea93e656d41b5b79973e02f938c2651bb40c75555c087b95f1c5b833a93752efee8b69def

Download Submit
memory/3332-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3332-932-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download