5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
Size

82KB
MD5

6f411750a55df816803f40cb07aa7076
SHA1

783f4ec89cc9fe60830aef2a9c343509fe4c0ad4
SHA256

5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a
SHA512

239790e38da26a96e8ee6f19618314e19186289735030b322c38463048826bc117527de3045946ae73f77024347b5ef0a3af97af88404ec46ce53a5f08c169db
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8IZum0mHXxXgOT2IOT2Lpp:enaypQSo7ZBXxXgOT2IOT2r

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5039) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4448-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023424-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/4448-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoDev.png.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.Common.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\desktop.ini.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe

C:\Users\Admin\AppData\Local\Temp\5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe
"C:\Users\Admin\AppData\Local\Temp\5a5a013a7e5f309bbab867d4e606f1d22d948953cdeab8f708fc7ddba105e89a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
82KB

MD5
a274dc146053af3bde577f9a71d55a31

SHA1
78ead1a794704393cef2d07f5be3f4ff4d31bfde

SHA256
201b0d1864f26f494b82020bc893e65a3f4f77f892a88774be8c6c88a4903014

SHA512
b8a98956a3428a04c4fa0e56e56cf0441e2584a3465ffd36614871dec8745f1477e742e697b51a979631b5be3d467f18e592be267de7b3f1e722c3f16b07b636

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
181KB

MD5
d53f12fee39273a77c182857d45560bd

SHA1
60a9d5764516a780d88ae822aba03dae712fd75c

SHA256
1cefe2a2d8fe4add827a16e5e5366232eb87e793d75734c948f3f4913582c984

SHA512
34df111933c79275cb86fdd1dc4536beeabca73ec3b31d0648e62965324e495f9282cc0b79168da3f8b842648e8b84f242ab88fd772324d031afa15e28c2c48d

Download Submit
memory/4448-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4448-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download