f9a17c4bafb60a7d6f52dc642c85f87eba6e1bbe9e2a835aa743091acd2c318a

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23e3a296df2d9a8d925e3bd78a92fcd0N.exe
Size

48KB
MD5

23e3a296df2d9a8d925e3bd78a92fcd0
SHA1

bc33f2d7ed6d33fb54b46430df1b4ddc05a9a1b4
SHA256

f9a17c4bafb60a7d6f52dc642c85f87eba6e1bbe9e2a835aa743091acd2c318a
SHA512

e8c335e6d100d732933e0c7a5838f815cc7288c2f7252c6bec8550a15e63122a24d8a6e56f06237c44877d61cdaa59d012a0f1530289cccc122b27407847070b
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9bJSsJSN:V7Zf/FAxTWoJJ7TFJSsJSN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023444-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3000-990-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-80.png.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.Extensions.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	23e3a296df2d9a8d925e3bd78a92fcd0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23e3a296df2d9a8d925e3bd78a92fcd0N.exe

C:\Users\Admin\AppData\Local\Temp\23e3a296df2d9a8d925e3bd78a92fcd0N.exe
"C:\Users\Admin\AppData\Local\Temp\23e3a296df2d9a8d925e3bd78a92fcd0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
48KB

MD5
e66029c537dd43e10fde420f44d588e1

SHA1
58a8ae15c5c1e313acd1484c2c801a6ffc54dbd7

SHA256
b1a24b95607a7c90b647052eb31dc55dd9a30e2f9f6562a337a64cad8f59a200

SHA512
c772fb2d9ff115b36fb1f66c2642dfcf7f2ec99c5a1f00a2cfb53eda4f5239449f2a49073563af692bc10fa0021329346bc5a1c73db99d1275138e7bdac8ebc4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
d91bea6524de5a3699c3ce41c8d375cc

SHA1
e8892ef1611545ebbd067c58b86a0f609b090ee1

SHA256
07fee25a9a7f7aeb0f5a461b92ef4365f004747f5012384e71d1a7e268353711

SHA512
aab4be5d656a2d5da7d75abb026d1100999f8bf75e536fd24901a19cb4558e170625be4b66e6cdfaa718633346a265fc539d7b6eeb3080ebb668abdaf462b977

Download Submit
memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3000-990-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download