ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
Size

31KB
MD5

414bff82428a1bc05cb63812fa1a6094
SHA1

cac9595ae2ff76aba344485cc2fa4c5ddba8ca2a
SHA256

ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3
SHA512

2aaf360999749b8946870282992679dca78f2701b23c0fc737dbd947fd24bc00d7292223b83f280a2988c2d894b8f50d63acf5d3059dc4644ce946af78037490
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+91ldUjq:kBT37CPKKdJJ1EXBwzEXBwdcMcI9P8i

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2032-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023453-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/2032-851-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe

C:\Users\Admin\AppData\Local\Temp\ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe
"C:\Users\Admin\AppData\Local\Temp\ba8616ef79ae7933b7e3c6aa41215546e901f1309efe4640336c8c6a6819c8d3.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
31KB

MD5
0a177b0ad330d7dea1406f7866ec7b29

SHA1
d2a43c82c4aac528eec48d0bc2354808095372c4

SHA256
d27b706568a585c043d06f5820fb2c791270d1b007ef8e752e7d379d64805037

SHA512
813a3f7f089f89732d6e7013d52e539031d734268562e40ef10198a02042c19b3eb81434c5f4d4dc0f9c505d87a6570d10105a84f44db625d092dae102114a19

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
130KB

MD5
91851075fc3fcb0a8849b4d47e2ea54d

SHA1
ffa4c7a863613f3280c57a0bd610b1302bf41dcd

SHA256
ada5495eb870c7163530c7842014b79766fd984d0565b44b4a749ec825c8a9fa

SHA512
23d9821b6d48b2186d6c59bdb39ebc599eb17011cd6baf22ff4929a2dfcd4f3cc435cb1ba2c57e5b2d130e40049cc40bc4880f24154e2e4b4b65905117c4ec0f

Download Submit
memory/2032-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2032-851-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download