c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
Size

36KB
MD5

8773cdab7c920da0adac0c90097d0b48
SHA1

84501313169df16d493b5633170d359f8e6648fe
SHA256

c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8
SHA512

10146bc1771f53feae28962bf4e31c4f9fa73f042ac3bc3ea52662d594407768e5c6f74285b64196a8bedc3e4d2e1655605ca9d01f1f95ed2de39cc0a11d8ae6
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJPbUEobUE51lRtJicszsOVC7KUU3i7KUU3iB:kBT37CPKKdJJTU3U2lRtJfOai3i7i3iB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4876-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233f7-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/4876-1033-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODATASERVICE.DLL.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-synch-l1-2-0.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcr120.dll.tmp	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe

C:\Users\Admin\AppData\Local\Temp\c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe
"C:\Users\Admin\AppData\Local\Temp\c58fd740248b335bdaae55fcaf2728d945f676f94d2aaf2e7f42550d8777a7c8.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
36KB

MD5
bb263babb1a51079d6ce418c86c58e3e

SHA1
583737d03364539bb5023b077afb309ebc0541b7

SHA256
07a57ecb372e19cc73859318127ac3552da210043b310be86dd533a9197cf4e0

SHA512
7b5514032f0b9e70d38be70b4d1a0f71a76122fbf60b3807f8569772568dabda1f904043a33cf93816598068497cb16e87c0d0fed0e83886e1101f5c140e6a1a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
135KB

MD5
5a22a81ba123b104aa4c0ec683b6a371

SHA1
e7eb693672b8fb0ff4f018ee27287abdf46f1116

SHA256
e577da82f51b1e675ec3d5dce9bda750c338f480428622e5ccb2bfac44ca2524

SHA512
b8a99aac244cf1f2c5c7d36ab827955dcb7c535cbb2edc1cb740a6c2adb4de220a96acff29f867bf0c6f67ccd9f0f5882b24f4f0c87354f2898e558d53b68d78

Download Submit
memory/4876-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4876-1033-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download