93e0f8da812fbd2eaa70104e5300090c8cad7cf1d58336ea08a28f10fcba15ed

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

580e3af0c61ed9a603bf411b5bfe4520N.exe
Size

45KB
MD5

580e3af0c61ed9a603bf411b5bfe4520
SHA1

f32bf1aa9928e61a77b20a2fc7b8cecdd4c61583
SHA256

93e0f8da812fbd2eaa70104e5300090c8cad7cf1d58336ea08a28f10fcba15ed
SHA512

7765c6923a3fc1d2b82e1564c637da2bebc28a197d58c7813c78c36ad1e1c547a599c0978ef64a1e5d976a6ac486cafbd9ce6f0f052b54953f7c359e08797523
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcKuU:V7Zf/FAxTWoJJ7TruU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5064-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023342-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/5064-958-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\mr.pak.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\hr.pak.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_1.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	580e3af0c61ed9a603bf411b5bfe4520N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	580e3af0c61ed9a603bf411b5bfe4520N.exe

C:\Users\Admin\AppData\Local\Temp\580e3af0c61ed9a603bf411b5bfe4520N.exe
"C:\Users\Admin\AppData\Local\Temp\580e3af0c61ed9a603bf411b5bfe4520N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
46KB

MD5
345e9a4d5ae2eb5aa7a80fdfe0d39fde

SHA1
0f8ebea3de079354f8fc6bc064b64cec478dd6db

SHA256
b4c7d01dd2ad346bdbda7f90c3cae9b4a0131c315a59191e88391af4f69f987b

SHA512
66be4a103dca65a1e08826a8da7056d7856abc06811498aaa5f932e7c3a9f4a1b7374810ec1e4382b162b1b51a874b02af2eac9ff10193496f1cb2a458175bb0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
144KB

MD5
62054f022c19f97eedfb2862d9aead6a

SHA1
1975650e6f328b12c2b7afa5e21b4f3734265f88

SHA256
b8a3b237fc974143c90f4cb14accff354e7d1234091ae891339ce49f00dd0526

SHA512
23fd01577164791f8b34fe1849f9db42d52ada8ba05a7d6c2d80dfd9d7b0b4ae5a27351cd33d6109f6310747a170ae859841226b1ce9178285230b5abde04244

Download Submit
memory/5064-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5064-958-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download