64e0ab7c23cd9a2afe055058ffeb7e619f788d0dbef92601427a2185bc38960a

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e29838dfdfc88e72334c45e103ee990N.exe
Size

28KB
MD5

5e29838dfdfc88e72334c45e103ee990
SHA1

06940a0f4a469dffd5f1f1b043fb372e039f90b4
SHA256

64e0ab7c23cd9a2afe055058ffeb7e619f788d0dbef92601427a2185bc38960a
SHA512

8c09d435327dcb61155395f4937f43067e669f72d3379614e33e6329acc400b01606286f22db9d3d87f07806e01efd254a722ae8bf3aa628e3de84e91bd49791
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9rqAoIJQxKCAoqJQxiqAoIJQxKCAoqJQxm:CTW7JJ7TF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1636-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023467-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1636-858-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Shims.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	5e29838dfdfc88e72334c45e103ee990N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e29838dfdfc88e72334c45e103ee990N.exe

C:\Users\Admin\AppData\Local\Temp\5e29838dfdfc88e72334c45e103ee990N.exe
"C:\Users\Admin\AppData\Local\Temp\5e29838dfdfc88e72334c45e103ee990N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
28KB

MD5
1571056c6611613e3d00b47218be79de

SHA1
57cc9fb26b3c1f997889a694e670a7edcfaedf0d

SHA256
752c028ff2ca58158e2e0d819a62041ab59aa1f88c00169315b5b756a0150cae

SHA512
23dd8f520f7ec1f7e57b80c069400072fa0e28def575e3289ab2d2bec1ae821c047036e70311f80c298e9385467138e25a1dc9440f46a6bdab53c475c7c4c340

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
127KB

MD5
734a761bb73a8bd45fa573ebfd927335

SHA1
9a614479526f15f0f224e92b64feaa02d31b9d38

SHA256
fe26c84a0e5bf1a45737027bb76bb9d047217d6765586ad3fd0fc3475a0a9c81

SHA512
1bcd80733a24f2a4f98bd46576a3bf6b72e208e32ce5f25ae191e81455ec9b96a8fee2b0e9f6f047812d7a1addd04ad94540911b7aba46b91a29b23f047c3e89

Download Submit
memory/1636-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1636-858-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download