5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
Size

116KB
MD5

7477bbc029e4613dbc4149e246f61cad
SHA1

42c267aadafbcc09047691f0247c72891de8a1c5
SHA256

5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e
SHA512

e222ee52e2fea97b052d04dbe6aa0f7a3c4e70aceef58f7fdf7732e59ae078f167855b80e87c0b939f108168b67897f3443b9d0a3f3445b48cbd694cbbc2cbfb
SSDEEP

1536:V7Zf/FAxTWtnMdyGdy4AnAP4zTWUnMdyGdy4AnAP4i:fnyGnpAunpAT

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4592-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002342e-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/4592-802-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\kn.pak.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe

C:\Users\Admin\AppData\Local\Temp\5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe
"C:\Users\Admin\AppData\Local\Temp\5acd68fb9acb18dad2df1fdfea888d334bbd40352502bc33b047f04a2aba806e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
116KB

MD5
dfb5c6c77497f2395ede6650c96f2a2e

SHA1
8b34639e3cf9a386bb2d1dfbc9f6dbe93821746a

SHA256
2de2562163362e05a306a6fdbfe25f69bd8169f2fd1397141590e7854a4521f8

SHA512
f0528de0e2ad871c4387c16de0cf57c6408beb15cf6fff39ea565579cba0831c08634bbe4f8789c8cd791461d78f513a87efd27ddfac9d0ecb834d95e0e1549c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
215KB

MD5
a28b5545373be1198761132f25304233

SHA1
96f83d0be124baa29ae3c5092edd0c0c29f96db8

SHA256
39ed8b1f7135edae4e0e99360236c5099ffb184d4e0e7d204c094ab36f2036f2

SHA512
53cf14aeeccc59e7c699cc273ff6cd5207ecd591891090b934eadada869da217797daea77f24fb831d4c1266dcdde2aa5993ad6f04e000773b0890f9478a3c9f

Download Submit
memory/4592-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4592-802-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download