baa73ba52f59510c7a33b6d9e8c83a11bf8f119094b560e498f544a669a759e1

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e832fb9e2826e3f5322c99e1898a640N.exe
Size

35KB
MD5

5e832fb9e2826e3f5322c99e1898a640
SHA1

9da9137f98ff8e8d901744fd4ae10630273d459f
SHA256

baa73ba52f59510c7a33b6d9e8c83a11bf8f119094b560e498f544a669a759e1
SHA512

2198a02d96a189796a7bacdc47ba33d67e2fe4c0293fa1cf86cd2c454af31f2ba4f8f72011c650a498d5f4df1c03102557e27f9f352ffd8ab69670255eb544a7
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9ffgT+i1xrfgT+i1xtAqJ:CTW7JJ7T5YXYh

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4654) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1952-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023404-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/1952-902-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	5e832fb9e2826e3f5322c99e1898a640N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e832fb9e2826e3f5322c99e1898a640N.exe

C:\Users\Admin\AppData\Local\Temp\5e832fb9e2826e3f5322c99e1898a640N.exe
"C:\Users\Admin\AppData\Local\Temp\5e832fb9e2826e3f5322c99e1898a640N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
35KB

MD5
a232f741053ab51e3c88bff1e2e898d5

SHA1
82a4852ffb3795c325261434c1d03316f6dd3b18

SHA256
ddd11c1ed206fb1fcbcd232f790c0432e2694ee8dfc8e85a014adf1d4a58e386

SHA512
fcb5efec0e278c3c08492ed3a721f0a62dc30ccc93b625a5d6f7341d003da76630a9923c9178d6d37536d14b60f826bf43790a56fcd0522e45e2b406deb7fee5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
134KB

MD5
9f010b382bac738e176723d08a046049

SHA1
97b04dc27f671d75e43b6cdb30aed14bc71f08ed

SHA256
e650de2224c3e273c8cd052a28f68d2c9c02088519e495c94a921df20fc2a49f

SHA512
fa96882dc726760d1bd94f9028b053f9c1ef1a7fc53e2e0086ff9a2d21661079a7a3774de32e044d465c0e685a7cf3dffdb72020434b4d1e16f18a86693552a9

Download Submit
memory/1952-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1952-902-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download