3fa08a9a4a0746ab3a4fa589cf60a804e3167cec3f03ae93f5f945fd5660f979

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4764a8f4c56a61a52ca533c86c0860N.exe
Size

98KB
MD5

fe4764a8f4c56a61a52ca533c86c0860
SHA1

4fa4c97f83131f89c48efae6a4725b31cabd11bf
SHA256

3fa08a9a4a0746ab3a4fa589cf60a804e3167cec3f03ae93f5f945fd5660f979
SHA512

192df96ffda6d7268844e7faee499cfa0a41773c3cd7f3c31ac57e7e04d1561ec6aa18282f6ccaf7b59d1a327a94e43f22853a7bb60e401679829fd7160b53c2
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTGl0Q:fnyiQSohsUsUK90Q

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4636-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002347c-2.dat	upx
behavioral2/files/0x00090000000234ce-6.dat	upx
behavioral2/memory/4636-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\v8_context_snapshot.bin.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\manifest.json.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\preloaded_data.pb.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	fe4764a8f4c56a61a52ca533c86c0860N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe4764a8f4c56a61a52ca533c86c0860N.exe

C:\Users\Admin\AppData\Local\Temp\fe4764a8f4c56a61a52ca533c86c0860N.exe
"C:\Users\Admin\AppData\Local\Temp\fe4764a8f4c56a61a52ca533c86c0860N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
98KB

MD5
42bb240b8e70a7137c8b165607683615

SHA1
c8b5e57723a71287cc7b27ad9df0a903053ee858

SHA256
af8bbd334bab365d58f8c3216b6b66774d01b8261260662394fa9058e6590650

SHA512
e36ab105958784e7cc07ab21e741ba261a8739a9b783e41f1d0d166e42c15a99cb2a34281725304ebb60aef2a526589f99f1bcba98ec23f4e28429d4d3e88f8f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
197KB

MD5
2429ff60462e1aa6709fdfc8a5786d48

SHA1
41b87dfe85c2d53b9643a06f0c2b1c8018e7d36d

SHA256
c594516fbb637d8a45829e107887780203da39728d0eef38974ae0aa8381b63e

SHA512
32539146c4b3d1766067bcacf584a9c31b6747d2f5d8bf931c5c51af85e5e2e5f2a1fc4ff8c0deb52e840f43347e292ca1870ca8212b58d89d12c7acb8967ff7

Download Submit
memory/4636-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4636-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download