e702a4a9e1f64386cc506df051aadb79b36983caaf15b387d9d422a42bc8cb4c

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e18d133efa26fbf469df238cb8006b90N.exe
Size

60KB
MD5

e18d133efa26fbf469df238cb8006b90
SHA1

24a5f4dfe8787b7db681731a86604e157259e24f
SHA256

e702a4a9e1f64386cc506df051aadb79b36983caaf15b387d9d422a42bc8cb4c
SHA512

2c35adf2faef769e78640b1eaa068c5fc0f1d45e4dfb33b75f8d6cb4f6173cc8de6a6d56b30bf20156120ad56fb65d9f170969c01563e102ebbc9b8f4f840059
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5+K2IkIA:KQSox58IkIA

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4578) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2824-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00080000000234bd-2.dat	upx
behavioral2/files/0x00040000000228f4-6.dat	upx
behavioral2/memory/2824-864-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sk.pak.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Common.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	e18d133efa26fbf469df238cb8006b90N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	e18d133efa26fbf469df238cb8006b90N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e18d133efa26fbf469df238cb8006b90N.exe

C:\Users\Admin\AppData\Local\Temp\e18d133efa26fbf469df238cb8006b90N.exe
"C:\Users\Admin\AppData\Local\Temp\e18d133efa26fbf469df238cb8006b90N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
61KB

MD5
c17a1c64c84539358f09ebc390320522

SHA1
ebb0ca182dec257f6e8b801b9753f662b9f33a90

SHA256
2907d86191a173a2136e7aac917e31743c0e6b14da30834f94e8f3859ea1e415

SHA512
0079c057c8fadef2b060806a5835bc16476180603302fcf63f79d51a241e989ce532f3556e41719586b0ce3d0a1854a675a5f612cefcfa6562dd31e1e81f87d7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
159KB

MD5
7275aa101ee8d49f76b5a46f4809eea6

SHA1
296100f43f07c3997493b93d39dccc4916835f8b

SHA256
6c801dc2b26cce9c147c54116b62536bb8fb381026c4294e2062644285c8b7e7

SHA512
0c183d9fc2474ac96008930dec2c80fb54b4c3aa561a0702935444db7096320fa0ebeb9122ba577c2368cb0980a809ec0c3c7f8ed7f177afbbda4f05c55c9fdc

Download Submit
memory/2824-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2824-864-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download