2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
Size

81KB
MD5

a32577fe51d545c658fea77b30ec2bc3
SHA1

f6828c41cc2be67b0840c4179b464a8589ede53b
SHA256

2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f
SHA512

caf3894b21df37462477c3017ee5963ef63d237c3a84803ee23793e8889a13837c5332c6eb9f0807c243e27547a187f3f933d0a19d6a3680b53ff39308e3c63d
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rv:V7Zf/FAxTW1d+m1FGe1HAAj

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5127) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1684-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002346a-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1684-896-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.tmp	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe

C:\Users\Admin\AppData\Local\Temp\2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe
"C:\Users\Admin\AppData\Local\Temp\2efa594f7f0fc65dbbf7b60b78cde3d2d81e10cc4666015d01339e8dc99ee46f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
81KB

MD5
cf8a43a79fc3be880c82d5b6afc0670a

SHA1
bde399c503c1e306667bb9f9ff5c559121bdae2f

SHA256
8ed5d0dc834709051e38d32c6758c471a9a8baafa9b4fa351d8373d6160460b3

SHA512
388586f59c45e1e0388d253d9f6b7aa09036e4dbbeef08c2884da4a15510823232f18c3136092f0d28994f27e5c186434710d1841d47088aa9f002ca62a71ef5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
180KB

MD5
2aeba9c4de6a56ed5a0ae0cc65a1237a

SHA1
f53eb0afe2ae816d93c733dfef063ea832ccc02f

SHA256
d7c8cbd19cf6f42f8a06473b2a2423d5880c071a820d6f341cee0e3d8ce487e5

SHA512
93f214faf1c4110fcddc821bf63bb5d8ab952cd32689fb23ef4e1b2641a4a53100a2a752866b22020fb3d8822072ca18117fa1e9769aff6d50550343336ae9d0

Download Submit
memory/1684-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1684-896-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download