5e8417f1fcecc7646bc7cc9e697a3b1fa440d3d5953abadb8c35f57e1fcecd2a

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49f604f0b248947b31113d4b4048e050N.exe
Size

33KB
MD5

49f604f0b248947b31113d4b4048e050
SHA1

be2f9ec7a820c67c3b662cde013d93f61ddb4208
SHA256

5e8417f1fcecc7646bc7cc9e697a3b1fa440d3d5953abadb8c35f57e1fcecd2a
SHA512

8db826bf5482070770c93272383bb544363776e83959a1bade82018943ac1b4dfe9cd0068510f5b7c548136d6877c0d4c8f97762cfe3e10104df189a38a51ece
SSDEEP

768:kBT37CPKK1EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeHhngh:CTWpOxn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5368-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002360b-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/5368-863-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.Registry.AccessControl.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	49f604f0b248947b31113d4b4048e050N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49f604f0b248947b31113d4b4048e050N.exe

C:\Users\Admin\AppData\Local\Temp\49f604f0b248947b31113d4b4048e050N.exe
"C:\Users\Admin\AppData\Local\Temp\49f604f0b248947b31113d4b4048e050N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=944,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:5612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
34KB

MD5
ca40ea36028d0c85eefe5f3b687564f2

SHA1
898fb70e6a62791523a11dc8859a0877e14e8902

SHA256
cdd2e3770cb42451fda1c50916a7260fd3f013aba820124116b5ce006c348b98

SHA512
5907acfbf8c306e2f5abb2af70a2e5514f7971e81f423409574f4b08bde3081de1c854e7795ba9dceada97b4058b8728df84b9c7d4aa8d924c9273d2ab209619

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
146KB

MD5
459680733a11e94f9c022bdd0a61913d

SHA1
3283202b5e2dbf6e3ecdd42d32f222690f3583cb

SHA256
b61b69db9d9088815bc25fdcbc6a19d8ec70e243901ed51c874114f406bf0cb8

SHA512
69372be6a569e7cd0ebec42ec04f1daf2efb1135dae00b5864154f0c2d1bc8b03bce78a3f6d298c1493a6ab8ee917f98bee891234e23af813a25cf5e01b6bd15

Download Submit
memory/5368-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5368-863-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download