ad8088ef225e71bab5064e34d8c4fe0425393f2d3fd8406ca762f19893bd415e

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3c2326949fa576af55c54a561dfa650N.exe
Size

73KB
MD5

e3c2326949fa576af55c54a561dfa650
SHA1

7e3f1f117d102d65621ae22fe4b391c3e4a93348
SHA256

ad8088ef225e71bab5064e34d8c4fe0425393f2d3fd8406ca762f19893bd415e
SHA512

930c5546aa4ae955a074c8a8870f5bd498796db9a74a057396ce617fb340e5716ff740ab38531dd71740267faa219e6cf21e00a7491b71f5f5c0631567e82eee
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjSEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rl:V7Zf/FAxTWtnMdyGdy4AnAP4FRz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4379) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3708-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233db-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/3708-862-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-phn.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2gss.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\ExpandRevoke.xps.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	e3c2326949fa576af55c54a561dfa650N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	e3c2326949fa576af55c54a561dfa650N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3c2326949fa576af55c54a561dfa650N.exe

C:\Users\Admin\AppData\Local\Temp\e3c2326949fa576af55c54a561dfa650N.exe
"C:\Users\Admin\AppData\Local\Temp\e3c2326949fa576af55c54a561dfa650N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
74KB

MD5
7794023ba39804bdcfcfc81cbee1706a

SHA1
ffd3fd9c3ea5e9b003827d7a7a1d7fb09ed98618

SHA256
15ae5f24dea5323c00a1577c3b3936607ee64e8109ac7d91d0665b51667b345b

SHA512
c4c23a22001355f5bf8da16a6191434ebf4430352930f2892fda2f32fa972e65cfc8b48e6aaca3e9929ae10c90233bb423ed3625e7156b0c8f77731c98ef526c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
ada766744c25b875247899a5c505f3fc

SHA1
a4966b15e9c121bc678f8d0c5a8f8e8732976d5b

SHA256
ee33b80bca4ae8711f7cae7ab31038e979aff5e6b10db1d18ed4389442a24593

SHA512
12b5dad035abd70c5418af0d2cc46cc270914d9415b86b6aa89f1c0a3f2288d4e5f36002b8cfcc1fdae30c0fbd03e29409eeba36e7b44d4afb09244f6b22029c

Download Submit
memory/3708-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3708-862-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download