17afa77ef2042e4c871474a747f98abde9c40ba62df8e31beb274ddde3851bc8

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51e4fa3e32319f3a35792371dce2f7e0N.exe
Size

31KB
MD5

51e4fa3e32319f3a35792371dce2f7e0
SHA1

60176a0872ac3456dc7fa3ffe97d31a7461051d9
SHA256

17afa77ef2042e4c871474a747f98abde9c40ba62df8e31beb274ddde3851bc8
SHA512

0e2012025da0ea1d802ceb03cd1bdc0c44bc4a6cd5c77b2322755ccf30ef28d21418c4710d4409650b42636d03fe37092c8e5ebcd2b720f7d8f02a68bb2010e9
SSDEEP

768:kBT37CPKKdJJBZBZaOAOIB3jM2jMO/7OSEz0z0:CTW7JJB7LD2I2IbSY

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4606) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4484-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c000000023429-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/4484-851-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jli.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\uk.pak.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	51e4fa3e32319f3a35792371dce2f7e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51e4fa3e32319f3a35792371dce2f7e0N.exe

C:\Users\Admin\AppData\Local\Temp\51e4fa3e32319f3a35792371dce2f7e0N.exe
"C:\Users\Admin\AppData\Local\Temp\51e4fa3e32319f3a35792371dce2f7e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
32KB

MD5
b1b8cf38770b291b70e10e0ab8b1a67b

SHA1
37f24acf860ea52b5e7c75da6ad375da40089bba

SHA256
3f9a39072782723861a1b01c0e3dff51a5cc159b5805977b78ca29b69c75b0e5

SHA512
3252e812dfabf44da73596bc9daf0810a9a1b5ddc375eee3a0633e2f2aa50c73562f0c91beb65467f567a71fb27cd78f5c85334c507a2a984203d16cd2b23d9e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
130KB

MD5
4759af3c637e73935aa3d690fb3acf96

SHA1
a3c08fcd331690f058fa25d61f0978b879923100

SHA256
1691e848b5d8707795137738fda665e5bd3b1e18a9b352f4dbf490070250d50b

SHA512
57e5614ed246236821c93059a512bcbf39ab90b0a2fa1ede57cb60af7a1ffb1ec23f52e4f0f4a931825f1ee1b189be1f60c0632845ce7cd23aa49960debc7cf8

Download Submit
memory/4484-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4484-851-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download