8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
Size

45KB
MD5

04bb4d3ef1f92c9b84b760a237cc2f0e
SHA1

d5e03f2c708f8c361faeda94e144aa08cdb6be00
SHA256

8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1
SHA512

8127f8329519d6182072fbac73c8f1020610529616543d08e578488276222d478eb90a3769c13f4095814db442f85bc4f2d92540129aae65cfdd1b4860b8d1b3
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiaZcZGWgDgHfZfL:CTW7JJ7TTQoQa+IWgDg9

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4576-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002344d-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/4576-923-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\netstandard.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe

C:\Users\Admin\AppData\Local\Temp\8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe
"C:\Users\Admin\AppData\Local\Temp\8a333486807a143cd9171172d9f88811828e6d72e1b83d1243bceeb2105954e1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
45KB

MD5
be0048abf1d08a623226b5e6e94b5791

SHA1
f63c4512dfca159c68f164131dbf69512048fd96

SHA256
4690676a23e479c4c9712301685c4c78a47d2640482579da76487b2160adc1be

SHA512
77801845b96e06b7e3788ac2d5ad4c4c99d5bc5adeda147a0a72941384ee97c5c38b748df5bcc92beeb9ba47c74fda32a31f2c7cde58a5dc2f6e382aec02d7de

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
13c7f7b377c41f37e090a82c7169a9b6

SHA1
9910a4e3bcd79888118cbb8c5102e2d0ed03b647

SHA256
66514c7c54ba72cf983f2230031b457b820546f632812f89616e727bfb551e29

SHA512
42adb7a840b352650a921e454c617c9fb1dba45c5302d4d98615dddd28de68e17f0d8cbaf4a4c327ca3a370f95ca2dab80fd2a28784c2406e00253282db7bbce

Download Submit
memory/4576-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4576-923-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download