f70d9243f13c6895232385954048df2d90c0d9e1bf981f9cd41ea12f76dccb73

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5fa5a5b34a0fe322ecbac602f62bd70N.exe
Size

26KB
MD5

e5fa5a5b34a0fe322ecbac602f62bd70
SHA1

9f2681bc4d963286f76a77e9d87064652e1a4716
SHA256

f70d9243f13c6895232385954048df2d90c0d9e1bf981f9cd41ea12f76dccb73
SHA512

1e1747ec681d20b08640330e6451da39eb91c7207941898ee7f45378c7335bb31b9b5ae520f1c282d32099f18bc80b63e64dfdb7d304748a2fed8d5d93e5dfdf
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9O:kBT37CPKKdJJ1EXBwzEXBwdcMcI9O

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2672-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233c2-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/2672-1021-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	e5fa5a5b34a0fe322ecbac602f62bd70N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5fa5a5b34a0fe322ecbac602f62bd70N.exe

C:\Users\Admin\AppData\Local\Temp\e5fa5a5b34a0fe322ecbac602f62bd70N.exe
"C:\Users\Admin\AppData\Local\Temp\e5fa5a5b34a0fe322ecbac602f62bd70N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
26KB

MD5
36ec6f838ce1ba2037d9ab84ff8a2f6f

SHA1
9caa71488421330deae68981ec7094e243eef8e6

SHA256
6f37f85741998c44b3c0aa3b168921fa8912872e35e1818ff79410c1eba93bea

SHA512
ab265255db793425a9ae530793f4ad7e3df84462be1d079e5dffe3c3f6af4bf51274b17440fc79a99194e32b08e1667e038e0da4f9d4695b2b093ac3de961134

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
125KB

MD5
3d29d7ae600cf39f5499694b37ff8c50

SHA1
f8c429f33cf2e82c12e36e76a9df3f79191553f3

SHA256
05aa2866a12eb118ad235b7f09c7e73150a77fdca556b26b798bcbeb4da4cb90

SHA512
efbea7cec75a92785fe594f3db63ddfce33f24de99bb1a315ca52bdbaab933a67b88ec27cef934972589d487173cfe8d5a51e0d6b6561f224075b76547f5af80

Download Submit
memory/2672-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2672-1021-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download