66878e0ebcafbf416e6c667ca4c78dd231bd0c4f6380d1f47f016e69523be96d

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
Size

60KB
MD5

a54e6f4ab0be0b44a5fe8e14e5e00b80
SHA1

8f2b8e43cbc049cf6c39aa6906e6083414783e11
SHA256

66878e0ebcafbf416e6c667ca4c78dd231bd0c4f6380d1f47f016e69523be96d
SHA512

f825d753a7a1efff228c916e928eae0db5e8fa43d27ced9028438a65dfff35a09f54605b6cfca9a986e10f10f9c987e0f40f27f358ed101ad325d8fee460c2f5
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzp:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5W

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/752-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023456-2.dat	upx
behavioral2/files/0x0004000000022922-7.dat	upx
behavioral2/memory/752-923-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe

C:\Users\Admin\AppData\Local\Temp\a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe
"C:\Users\Admin\AppData\Local\Temp\a54e6f4ab0be0b44a5fe8e14e5e00b80N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
60KB

MD5
0f57e790ed97e2c115236404f731547b

SHA1
fb34029e06546b419504aae0803c7c42a6eb1f85

SHA256
6c7427d02167fbdb7b55136bd4828ed8001d99d78c7a2fbd3a6bc146935137d2

SHA512
39f8aa22b22563441dfbf6a145d0ad52d76f68f52f0dfd2e87695fdda9cafa6a2cd652e857fa215133cbc9ecc3bb8fc70bdac38e8947b8abfdeb854271b3a497

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
159KB

MD5
ac42b347b915927715e2406948749494

SHA1
0b031618ca92c12654569fc371e276b915a1b76d

SHA256
cc36cf21ebc52321006e01b6a6e2b5a270eb46a05efb680f46931a4d8dee31da

SHA512
a1cf60da1f70f9d63abe229cfa1c6ce2e24b6d4538aee53b863757a1009378bfd792d5362124feae7febf9244add05d99fd69cbe19ebfd15971228cf2f6614ed

Download Submit
memory/752-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/752-923-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download