5ef64053ba8dc2e624358826e4629e70b7d0ad51ddfd368379eb60ca855445fc

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 11:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8dbbfbf9172a868a45d8b722f28db80N.exe
Size

39KB
MD5

e8dbbfbf9172a868a45d8b722f28db80
SHA1

4992a9f980486fb8ada51300f5d46abe50e6c715
SHA256

5ef64053ba8dc2e624358826e4629e70b7d0ad51ddfd368379eb60ca855445fc
SHA512

feb996c3aaf039d76bd7746aaa6be0693aba5508f9047f14058ea83bebd3c10efb8a97da8937710128321b1aec557b21dea3c612ffab70fc2800a5e4e7814fb7
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNydWK9WKvhNYw05jYw053:CTW7JJZENTNyoKIKIwBwM

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4674) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1892-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233e5-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/1892-929-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	e8dbbfbf9172a868a45d8b722f28db80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8dbbfbf9172a868a45d8b722f28db80N.exe

C:\Users\Admin\AppData\Local\Temp\e8dbbfbf9172a868a45d8b722f28db80N.exe
"C:\Users\Admin\AppData\Local\Temp\e8dbbfbf9172a868a45d8b722f28db80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
40KB

MD5
326b1d8392fca8a20c04861b8209ab01

SHA1
fe9cd4e668eba4a059527361a21f6ff82c8325cc

SHA256
c254be3a16c029da0e7c49b3b5d4ce529bc46405a837747fa0dfe89c8616aa1f

SHA512
451434ab4142992ab4ac5b0f8743c8d8cedd38b35f4e58f7406acff4c6abca53baaa8ac23c784a12c2f88849b31aef66ae4a00961ba2e46421cd4499f464efb2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
f6f999d19ee1e4828c957d9cf2993cd4

SHA1
90c73d98f03881120f340ce312ae40e2314b1566

SHA256
6f7e054ec2a541b15d9dd7ed8974dccc8006e1571d8cb3e11d4d7a8937a3fd74

SHA512
fbf6622c8a46852c897a8a9ac6f5261126b441c5826c74f59c97b976a4d0bb914bed17c7d2dc9f40da865165e409547d31f38a40078bf315a6da5e200633b708

Download Submit
memory/1892-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1892-929-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download