a7fe8732b21e18d0d765e045ed6355d4e289c5989ec84450d0b4b714fb06e2cc

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a03afd8af013cb153a26d50dd927f50N.exe
Size

56KB
MD5

0a03afd8af013cb153a26d50dd927f50
SHA1

c4b47102d2911aafe69da6e58e8d1734c8d064d5
SHA256

a7fe8732b21e18d0d765e045ed6355d4e289c5989ec84450d0b4b714fb06e2cc
SHA512

ab532400e5f6fb018c91f76d35e2f7b3a5b458f30308ffab5438e0eb90cbc694950cb56034909920f058d5e32612e91b32cf6f3f50d91154f869a11ef7541bd6
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBApwp133EskmKV:V7Zf/FAxTWoJJZENTBAOIfmKJfmKQG

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000234a8-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/2032-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	0a03afd8af013cb153a26d50dd927f50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	0a03afd8af013cb153a26d50dd927f50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a03afd8af013cb153a26d50dd927f50N.exe

C:\Users\Admin\AppData\Local\Temp\0a03afd8af013cb153a26d50dd927f50N.exe
"C:\Users\Admin\AppData\Local\Temp\0a03afd8af013cb153a26d50dd927f50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
56KB

MD5
1131f2394bc0e44538d2821b0db7201a

SHA1
8bedeb65e62b2c2352a65f88a3374199040db07c

SHA256
839e0b17d6eab2c549c46e79781c2460df60c5dd3e6ee194308ee948e2af7f2a

SHA512
b7aec696006b8f54a24610da67eee1e10dd646bafb1813d05f6a771b7a51fa9ed55edc9f3c080d3de108bcc7dde75400f369073ccc4ab503f1cb031bd7d864d6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
23a8f700c46f79baedb36f6639605b9d

SHA1
a5cfaddb58857f5311dfa07bc4a0355872913bbe

SHA256
b8b4ccdad2bb14b3fb7ef50c566c360c11c499847a5f75b69b0e7b73d83cd781

SHA512
1ec381f1859a7babe7c0dfc5eff6362be42fd48e4ebb4a21fd788d6fb3da781a37822f6b0799343fea04b864ab41a94fb04511a5485fc5c7510497941aa5ac14

Download Submit
memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2032-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download