3a4ee10b32496448412e4d45d4dbef4e6edde1d98720ef74c6f165b1d4e541dd

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a604b18849332d4e71495caa39f7590N.exe
Size

73KB
MD5

4a604b18849332d4e71495caa39f7590
SHA1

a6e334c277eccee93c52fc01fad1a58631323c9c
SHA256

3a4ee10b32496448412e4d45d4dbef4e6edde1d98720ef74c6f165b1d4e541dd
SHA512

0c714d063c17c642ba41b246afb8d5fa80429894a60e4895d19b14455e15b1fb5d0138a75c8179bcedd6b18c92e1f31cfea6f16290d41eeaa43b2afe7c12a583
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQ6:V7Zf/FAxTWoJJZENTNyavf73tQqO

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/744-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347c-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/744-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\sRGB.pf.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	4a604b18849332d4e71495caa39f7590N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	4a604b18849332d4e71495caa39f7590N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a604b18849332d4e71495caa39f7590N.exe

C:\Users\Admin\AppData\Local\Temp\4a604b18849332d4e71495caa39f7590N.exe
"C:\Users\Admin\AppData\Local\Temp\4a604b18849332d4e71495caa39f7590N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
73KB

MD5
be6ab995427b6ef521ce1e1a34c9469b

SHA1
414ae66bbf053ea62c5502977b900a943dffb571

SHA256
3e7af0961aa9c9843aecdd4c5ef3eafaeba0d6e1c2ce4ea0ba4980c91cf6e461

SHA512
1745bd9e446232cfdf747d3a49583d12e63f5f01cee8e486494fc7f45abeaf0773b6c2563a5d56c14d03026fc749486c72f3f86fd97a9505c87f5cccf66d5828

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
def187837c44788d35a81ea65af4813d

SHA1
9fb08aab7faeeb0d9fccc9f1bebffc6ac35b1dea

SHA256
772c350a7d77be0fa28c72db841cf10c3462943eb3af4baed4d851fe6650229c

SHA512
0172c3cbc0dd230a8f1fb7c988fbfaf1e0a30f6e23ce14a47a40bfc4f1ede6a08eb40179c3c781097b3c535063ad2578993d1e42439c23afed62c8747475999a

Download Submit
memory/744-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/744-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download