43ef0fa3dd101cadf7ff73e043837dc6d658a82b40f65fced311795a8c9b347d

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dee110e57390b33981e1c1befb3501c0N.exe
Size

30KB
MD5

dee110e57390b33981e1c1befb3501c0
SHA1

9f334a242a9c5fb82ca10f352daba7d0ea0baa93
SHA256

43ef0fa3dd101cadf7ff73e043837dc6d658a82b40f65fced311795a8c9b347d
SHA512

b57c14a7b453294f400693edeba748f3a9218d640cf85eff2642891ff00041560718e78d1824837b651022e64a4b265dbbdf159c8f55ddb366a1ec401d6fb799
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9nxOP+UDpOP+UDJ:CTW7JJ7TrOP+UDpOP+UDJ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4685) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1944-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/1944-1007-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	dee110e57390b33981e1c1befb3501c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dee110e57390b33981e1c1befb3501c0N.exe

C:\Users\Admin\AppData\Local\Temp\dee110e57390b33981e1c1befb3501c0N.exe
"C:\Users\Admin\AppData\Local\Temp\dee110e57390b33981e1c1befb3501c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
30KB

MD5
9407d627accf64c7404cabb625bbb9cf

SHA1
c51cfca0170435344812df2a14936a05ee668a77

SHA256
75d72eb3fc67eb2842f4f56230add7d41da3a5b17e9f93dc97d4b58af846f2a1

SHA512
a3f79067cc52bcbeef3b02f7e78ee6c09dc898ae923534736145db091aa4c72876aa0edcca2add3cd487fc34c3c024cd29b674d2c22ea148c3e36e667fa5acbb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
129KB

MD5
031e4a3ca5f82b8dae697a9887e73b92

SHA1
9f76feee8959476d05fb125447731912eafcd99c

SHA256
0c1d74c590dfcb627a1c095dcb8aacd866ed5cc06c080d3367e188aee9c7fbc3

SHA512
45ac1e1cc43cd1b54354dd7eecf16f14e6dc4db4bd41a54517d497f7aab3d5bddd6e6526927c2bf35652c6812ca823618fb563b4fe4325f3696cb469454b588d

Download Submit
memory/1944-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1944-1007-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download