f6e6075be3f4cd31fa449a5bf2bb8bf756b1656194f64059a1dd8ba57ec9d0c4

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef759cee387a9811d590eb3e51be8810N.exe
Size

52KB
MD5

ef759cee387a9811d590eb3e51be8810
SHA1

b5e8066927f061bdf6381b1c20893b242e8273f7
SHA256

f6e6075be3f4cd31fa449a5bf2bb8bf756b1656194f64059a1dd8ba57ec9d0c4
SHA512

819f29cdd4de4881901fdf8262d7beebaa7afee0f42de88ed8248e2160d84b0ea8956c44ddc7b07a565f2c0f52d6d0ecdc954d2fa85c3faf3c48009a094cc257
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9GoCtOVijJ1foCtOVijJ5:V7Zf/FAxTWoJJ7TatuK1

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1328-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023488-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/1328-930-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Controls.Ribbon.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ur.pak.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	ef759cee387a9811d590eb3e51be8810N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef759cee387a9811d590eb3e51be8810N.exe

C:\Users\Admin\AppData\Local\Temp\ef759cee387a9811d590eb3e51be8810N.exe
"C:\Users\Admin\AppData\Local\Temp\ef759cee387a9811d590eb3e51be8810N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
52KB

MD5
ecdc54693748da0bfaaec8d9cf794dbc

SHA1
3c9882a03cea6ca48f23fd51bab271e9d3dbfff2

SHA256
b546720b08fd1a9768c0cca6a69ae443955b2c891ce47c969862210ae59b1d32

SHA512
8188b0ec87f721c27871edfa67ab94bc9c9517602fe47e507be2165a63a4043750ddf218f57a9b516f3f8fb87bad03de4dd38bb60d38bb3d3b0db245c43c20ae

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
a90d7692b786a920299c9e4e0659739c

SHA1
8deb4875ef1c1f5ade512d24295f3d615b57d95c

SHA256
9bf16bf5b29526d8ec7e51b44b2b46df393f4d2829ec28544845d7927393d846

SHA512
feb835da17dd68edb8576a44e7b8b20e137d70ee432de765a8d0710f9686707c305014dd27305e2891179124e30d949e1cef3ae83cea289f1664a1850c5c68c0

Download Submit
memory/1328-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1328-930-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download