29b86bc66d72f809499ff440b885a151f1f493fb30303785dca544a7ee44a043

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e142fde4f945624ca878e1775e8d3e0N.exe
Size

58KB
MD5

2e142fde4f945624ca878e1775e8d3e0
SHA1

bb8b9ba8528943b6670153bcaa4fdee6233d3a4c
SHA256

29b86bc66d72f809499ff440b885a151f1f493fb30303785dca544a7ee44a043
SHA512

d5034cd3fa786149f090373efd54bda5c50c40c1a839d88167f50a9ae6fff23e42cc91718e6549740ac5e7f48b22f8d5c33f115044fa5c74e04bc0d205f1e653
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7EJJcbQbf1Oti1JGBQOOiQJhATBApwp133Eskmd:a7ZyqaFAxTWbJJZENTBAOIfmKJfmKSJ

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2024-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000234d6-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/2024-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	2e142fde4f945624ca878e1775e8d3e0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e142fde4f945624ca878e1775e8d3e0N.exe

C:\Users\Admin\AppData\Local\Temp\2e142fde4f945624ca878e1775e8d3e0N.exe
"C:\Users\Admin\AppData\Local\Temp\2e142fde4f945624ca878e1775e8d3e0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
58KB

MD5
3dafa9b9b4e1ee28c809826bcd2cb9e4

SHA1
a0a732b3027e4e9065bab2bcbe8046eaffcfbc0e

SHA256
29c0f4f47d8d407ee0ad551c270384f0c9759269e05293956e12afd3841872e6

SHA512
71a2268f95ba7b6efde0b9130c85800b8ab308fe1629f84b704b56813dba4a85b85526cc62d09c340ce325d2e2f9779d5a1abf7688d4b1ae8caf015c0610fc7e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
09a3c743f486b572a51a00cc32a48746

SHA1
e90895d84c840990f7e3819aa2144869f517e887

SHA256
48d20852cd6779ca56e715b02f4403a3a5d4bd35192e7e757966471524bb265d

SHA512
4bf89f827027a1a174536a334c4b152a3f751ffc6dc962929046b1750fa3b1cfecd97408410e5515eea41c89ac8be707e2e33105ca575532c2789a2b1bac2a61

Download Submit
memory/2024-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2024-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download