2d94570c0c9b810db4555096c89d170cbf6fd12877c7773dc1f6e09d6d004b65

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e2b888c023c383b61e41c6ee5075fae0N.exe
Size

28KB
MD5

e2b888c023c383b61e41c6ee5075fae0
SHA1

b9c331aa190c12e312f8c2d1fc948bd212a3d536
SHA256

2d94570c0c9b810db4555096c89d170cbf6fd12877c7773dc1f6e09d6d004b65
SHA512

beb5dc79ba887461bea038a41257f3986c851830b369172584a01eded2f03b8bcd805bbae5b38dd1920acf748b986f39e121eea97e28e31b53575dc80ea25c72
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Sw2Yw2e:CTW7JJ7TE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/676-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023637-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/676-876-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	e2b888c023c383b61e41c6ee5075fae0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2b888c023c383b61e41c6ee5075fae0N.exe

C:\Users\Admin\AppData\Local\Temp\e2b888c023c383b61e41c6ee5075fae0N.exe
"C:\Users\Admin\AppData\Local\Temp\e2b888c023c383b61e41c6ee5075fae0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
28KB

MD5
890a71429923b5c2791d4b85868fecfa

SHA1
4881539b668c55b3eb672b6a632bfb3a6aafd69a

SHA256
019115381a8d1d2cb495d93725a40294dee3f1e82f978a3941d524e08c0959be

SHA512
0d18310ec41e6b62843238e1dd080b7b36a15ca833b9a1a317e45065a7405b3a2b06ca5618caae8637e77c9b6de2e2151ade6e69d12fce066ec66b98d198744c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
140KB

MD5
49488468c88b9ce2dffa77f155860631

SHA1
bea62a7f561ca82725d8a741823f22618fd64e02

SHA256
aa0da7eef42ee5877799c3a68b36d3da7140b832a76053e3004330683c06f327

SHA512
81069a9e9d8ad6db3100a939e0cdbbf65f5da09382bb484edbef105fa707eda76281a8fb8f90eb1346c99b8d3f3dd01c0fa664e57841a2bfa9b6e31626c55d2a

Download Submit
memory/676-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/676-876-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download