036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
Size

62KB
MD5

6a4e99b4c796cebc58774b73b058c6dd
SHA1

00d39cab6698f20692325392f80859d9e700a237
SHA256

036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f
SHA512

0b8a411c4c138b0fe2b805fc74e0978c228b1083fdb2d5a28af26febbc9b95c53226bba4eaa7fda0a6c1991e47d3eeded23015d9652b9b0caf0c8412655e5b88
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tiRgNAgNS1:V7Zf/FAxTWoJJ7TTQoQSHSORKn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3976-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002346d-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/3976-852-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\FindExit.midi.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe

C:\Users\Admin\AppData\Local\Temp\036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe
"C:\Users\Admin\AppData\Local\Temp\036c0ee4f37569b8816691d8abbc9f691b879501001ebc54bb649d7753b1370f.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
63KB

MD5
ee3f0f783b48fed2f04b9c012f9f745a

SHA1
f9ff5ee0fad929b8f0685fd4532a16aa5aeef30c

SHA256
19ff3697b8bdd7882cb03f7abf71edcec162740d849d8969e367a17b7bf27ce5

SHA512
7bad7837a99996a5c1fa760201f7b0baa8e72f2626bf979ab68d95c0691e2254b15865a2c79145ce8f1026cf8021c710da13d6ae973fecec76af93ccdcc8660f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
c1bc45fd89de178150643923d370a3db

SHA1
c2324241f901bc6888ffc4f55d59dcb1f04653c1

SHA256
fd7ed9cdb830102517bc91364525bf8458a10a5a8d093b8c6e08d68c0e5d4d54

SHA512
1fd36398ab0841d95ec8ac0cc2bd5dcf542147efe1a76812e760d695f9fa8dab6e103365bb6211123f62073f60de6a1e06cd374b12a8bb27600216e8115ed1be

Download Submit
memory/3976-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3976-852-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download