0e16734ad6669cc91ef422d25fee005bd9c6883f05fdfda06052a211783a8772

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ed1f98c791b50eca0a42aba46bcd730N.exe
Size

1.0MB
MD5

7ed1f98c791b50eca0a42aba46bcd730
SHA1

d2b3be623c6c30a0f559540a3870d34613a7a717
SHA256

0e16734ad6669cc91ef422d25fee005bd9c6883f05fdfda06052a211783a8772
SHA512

187f73ee7d58551247f512c9a856369679db36125d712405ebe8c10ca832c989b5a17106b0e55e4ec06fcce54f2c9208bef2217e8080a0144312cc991c99e0b5
SSDEEP

6144:KNQ3RjTSP8ZeVdiZQjRBPCr8YC/htdCfiJYHSxKQjZHFR2W52z8urkL4vL/cAGF3:rj0wZQsE/hv28NeBbUjwG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1772) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1804-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023490-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1804-378-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Design.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.PerformanceCounter.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	7ed1f98c791b50eca0a42aba46bcd730N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ed1f98c791b50eca0a42aba46bcd730N.exe

C:\Users\Admin\AppData\Local\Temp\7ed1f98c791b50eca0a42aba46bcd730N.exe
"C:\Users\Admin\AppData\Local\Temp\7ed1f98c791b50eca0a42aba46bcd730N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
1.0MB

MD5
2e5b71144616b58b7acdac3c63b8857a

SHA1
53d50868c3d83cbd0d3cb5de26f934ffe3c27a75

SHA256
9e61acfe2c6ef06b5ba52b42f39becbd1749e6ccb14183b26913d74693516ffc

SHA512
321db36ea44b17f3f3ef1cd57f7b46a015a9955ef1a7a46ae799963fafffa9e93dbe47c70dcf9fa9394bdc026ec3b9ecb0b11ffd45db9026682affa7151979b9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
1.1MB

MD5
9a7920434fa8571ad77e3f55d9105236

SHA1
de18586e51a102abf804e6308d146c7a2a62af3e

SHA256
4264abd1de5f4fc645ad594db70edfb211bb0857baae84b9d8ad9e8509876ee7

SHA512
ae08e7f831a23f43d30971af809a3911c54e8128d5edb929c59742bcbb33d429679f20f733f8e2a3574e480d3d67be343d3a653739331713c936a56b30640ec4

Download Submit
memory/1804-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1804-378-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download