d5f4fa0795e0a5d6bb551f2024d82e59bc5a2994f86678d91144289247e2f597

Analysis

max time kernel
120s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

51607e54a2cefcc1b0e271d572a1f7d0N.exe
Size

112KB
MD5

51607e54a2cefcc1b0e271d572a1f7d0
SHA1

eaa2e0bbf9d10b3cb422e16872717608dfc83e57
SHA256

d5f4fa0795e0a5d6bb551f2024d82e59bc5a2994f86678d91144289247e2f597
SHA512

f8c944a454cf9d0f9ce9874643e886c9689a9fc10990a7119b47e6a9a5f7a7250170ccb7deac49a963424e579000042cda36ad966cc19bb433cd58ac27618ddd
SSDEEP

1536:V7Zf/FAxTWoJJ7TOECjTuKBlei1yAspnSiumcxbPjnw:fny1uEgyAH7m6bPjw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023442-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/400-848-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hi.pak.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	51607e54a2cefcc1b0e271d572a1f7d0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51607e54a2cefcc1b0e271d572a1f7d0N.exe

C:\Users\Admin\AppData\Local\Temp\51607e54a2cefcc1b0e271d572a1f7d0N.exe
"C:\Users\Admin\AppData\Local\Temp\51607e54a2cefcc1b0e271d572a1f7d0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
112KB

MD5
08c8331d33b67c5550f0a9c4d5a4260f

SHA1
25779c39f00440905dee48b00367bae193b12893

SHA256
392a7646455c4f52bb205d85a5f8c64b63492582f47e3096414343c9cc963b0e

SHA512
eff5f6b5afe47b93ec6046c66ca11df2d2e1738fcd1b61e1c168ac7904d0a8af9c3287a4b73cb969a93f63d2eab7780459150b40d234ffab6fc6b1e763dda5f7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
211KB

MD5
3ec8ad2499af5ec4402e76f2c8298470

SHA1
8c89e27d0fb40ab29c7d7895321f30ae287f20a0

SHA256
682b362ebbaf5f77708cb6ea0f0d6108cef7e086d558933fd6e41b3ad1ae7f2a

SHA512
3829ffa8943ecb2a940d5a2617b3778d3c5a584776f884da658c14e199b52a3cf8c42139605217bc477e180200cd1dce1d6058ca24e1d06d8224701bd9c32e13

Download Submit
memory/400-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/400-848-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download