f0be1651f4737cb16378decfedb7c1cac1f8d27548f1c2f4430516f63f554e54

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
Size

77KB
MD5

e2ab8f8e3ffa1eb5c7ef90bd58f980c0
SHA1

611184473f3e9010bf99261f4ed10f5f832fd24c
SHA256

f0be1651f4737cb16378decfedb7c1cac1f8d27548f1c2f4430516f63f554e54
SHA512

606d3f44231fd9f2378ac009696a7140abbc69a5667155cb92591287c13638d073a00bbb47fc550c74a80fb8aa2b0427b03199d902073d4ff81a2d2475bc7c33
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZc:fnyiQSo7Zc

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4508) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000800000002347f-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/2976-812-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\ConnectInitialize.edrwx.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe

C:\Users\Admin\AppData\Local\Temp\e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe
"C:\Users\Admin\AppData\Local\Temp\e2ab8f8e3ffa1eb5c7ef90bd58f980c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
77KB

MD5
b13fe455cdb6dfc02a1175f13f623199

SHA1
dfad5d282ba6881f923fc6ccee0dbad232675346

SHA256
47066a85cdd7bca20d8c8d8b3f9f90eecbe6afcd982beaa4fdcaad9e2d5b6bac

SHA512
f1be31af15d86f84a2e897332f6883b7766d9b190ac8a539afd8e5e1493102b87b99913b316f956bc86296e102956b236db2b12246deecb465a9d8a72853ec91

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
6926eeeb7a1db6b11c0d3727c0715108

SHA1
cf38bed47f8e35f0ab310613bfc3faae96a05827

SHA256
19888ee849a88c0e8fc10b9fd1a0bacc9252c0abc0dffc8fc3856cb6d9756315

SHA512
831d7b14f2d49e7923702d5ae7bd94397aec4e337681e56bf8a061419f05156a34454be58657dcd1040da9a262d896903325f6d4cba015636bcae99d91aa5518

Download Submit
memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2976-812-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download