5201352ae6d7cfdf7416b37bce794121e0452d35cbaa45ca4696bf2b5650ce90

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

58b9146593a3419650fe6d31336a21c0N.exe
Size

76KB
MD5

58b9146593a3419650fe6d31336a21c0
SHA1

2f28257656d1817cc1436026699c95acb675233a
SHA256

5201352ae6d7cfdf7416b37bce794121e0452d35cbaa45ca4696bf2b5650ce90
SHA512

f85a4ac5face8d40c627b99abf1eada1e5ef4319af5aa940c502cb09f4bb1ffa4982b12c02e06548ecfd81d88ed2d9ff67cc7228e0b5e82c226313242e9b0b89
SSDEEP

1536:V7Zf/FAxTWoJJ7TVTW7JJ7TXEvBnHHwTVEvBnHHwTd:fny1K7T3

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4601) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/216-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233d9-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/216-850-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\FileSystemMetadata.xml.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	58b9146593a3419650fe6d31336a21c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	58b9146593a3419650fe6d31336a21c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58b9146593a3419650fe6d31336a21c0N.exe

C:\Users\Admin\AppData\Local\Temp\58b9146593a3419650fe6d31336a21c0N.exe
"C:\Users\Admin\AppData\Local\Temp\58b9146593a3419650fe6d31336a21c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
76KB

MD5
758db87bdb9bd1df63283366fc62a65d

SHA1
ac0a761bf6522a711d5b40cd39b9af02641bc96a

SHA256
e6896242248378160cd667a8dabdc29bb1165e217ff702a37face7b4744657fe

SHA512
11fe82190cf6282ab79897e6815318c3fe9dd1f2c83f83703ef15157bb07d60db5f9065d37c6170bd04df0280ce864f72a192aed1a18f9d22f281f709383e36e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
00224a0a303058480c4208795192005f

SHA1
40c8ba82727fc6b2bfeb4a40ad23adf3f6ca449e

SHA256
1f1ac8e9a608e2f9bcb54b35b35fac5523029edff72ba2d5f968d38975ee463e

SHA512
ce003d35775a0f8a353ccc3c5f244efd21611aad81162d2c991bd6769d05f5e65d8cf75ed5d2ba43b85e55ed6cbe2d63ffb004f5cf01d2e74ead52b43afe8518

Download Submit
memory/216-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/216-850-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download