48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
Size

111KB
MD5

a1f34f3a030f63bccc2c6ff58480f038
SHA1

a94fb44a1c2890650e8a38d4d32c0126a6805450
SHA256

48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd
SHA512

a17d1220183faacf47a13c043f7da3775cb05c5beb54e746ead0df345f82706cb1651326d2b9b41237b83b206a0d738d391c93bb10dd36a63635da5ff09a8410
SSDEEP

1536:V7Zf/FAxTW7Mi8IRc14ilag4rI2bIXuei8tIoS65PNi1LVL9r+qcNqNts5L3/rbY:fnyJwRrRtrXy7w

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4917) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1584-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002340c-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/1584-844-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader_icd.json.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe

C:\Users\Admin\AppData\Local\Temp\48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe
"C:\Users\Admin\AppData\Local\Temp\48198099efbf998716f34bcaefbff34347baf9363bbb4b2070b99bc92672d9fd.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
111KB

MD5
1139c9806a8c15a6d43558061ea858ac

SHA1
538fff376c993fa7e0829a27bd83b4899d197d05

SHA256
129620d1e345c0a016021d2f8588b721736771ffbbeae577171b97656a5f3476

SHA512
e25a6a66984343f21750732bfa6467eef0b22426e3e02874c572a7e210dcb213fc1dcdebfabe930141be1141e2a74cde0ea0c0b17cf722b9951ef77c0f6bed20

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
210KB

MD5
0f8372c3d003813e6448c75f4e334a8d

SHA1
bf292d642e5e8f5f058e58533302f47f6bc0e316

SHA256
dbe12d607fbd628efdd0e9f5ef907c19b1a8c6795af1685495d1c3e354c5e9ff

SHA512
ddbd162fcf2163c0ff1533402c07635a60e5ad0d06f5fa11be148790f4bf9ca8e14d56098a6eb80be5d0538017d4e21451db874a4a424887d8aa7696d25ba8ab

Download Submit
memory/1584-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1584-844-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download