57f954ab775b20bd95bdd23a1290e439c7829364db5eb5295a68e00ef2afc10a

Analysis

max time kernel
120s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2595252e38d8d2fc3ac1e7764fd33e0N.exe
Size

46KB
MD5

c2595252e38d8d2fc3ac1e7764fd33e0
SHA1

a197465ae6f4dfd40efbab03ebaa100f2da470d9
SHA256

57f954ab775b20bd95bdd23a1290e439c7829364db5eb5295a68e00ef2afc10a
SHA512

2be35e7482d7bbdf3d2aaf80be44a500fe50fe1314ebd5ffd0b286aabbca11e2e28954ddc39bdc1420a7bbb7b1b782c27a0d7ff91661fc6833c6190111a98985
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI90TAYJXTAYJ5:V7Zf/FAxTWoJJ7Tm

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/996-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233c2-2.dat	upx
behavioral2/files/0x00040000000228de-7.dat	upx
behavioral2/memory/996-890-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jce.jar.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	c2595252e38d8d2fc3ac1e7764fd33e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2595252e38d8d2fc3ac1e7764fd33e0N.exe

C:\Users\Admin\AppData\Local\Temp\c2595252e38d8d2fc3ac1e7764fd33e0N.exe
"C:\Users\Admin\AppData\Local\Temp\c2595252e38d8d2fc3ac1e7764fd33e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
47KB

MD5
a69134072892140e287e1ba49fa3a123

SHA1
2dbfc5489f347a3811b7addeab4c69c6381f3b26

SHA256
44a28db665f871bc0d99daee6a810d3658b90f12da95eaf7ab68dfc1f68d2563

SHA512
a39452b575dec12e5c3905507cde7fe6947ed0163f7f67ad34333c0b3cb64e791eea1fb30f3984c4fdf3bd9810281db13725cf9d50e0c5fa1eca2eab0457fff5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
145KB

MD5
b842043e1d3984ce8ac153d8e9d1e6ed

SHA1
4cc034b1944ebcd261f43133773c6a763b218a72

SHA256
509ee2c0e47ae19cfbbf191def55d5335065b7a1b38b8add3b70cae3a21d1fbd

SHA512
6d2700c25a219b9ca7c2c3d09eda26cf98995b8ae9421dcd4783f8f0f137a0eae3820e69eee24605f0edc8857b8c4f41a68b56716a028cd5adddb4f1b93269de

Download Submit
memory/996-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/996-890-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download