72a2ea0833f2e01decf4b31882d25a9003582929b670577be777455f602c247e

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a428de5d2f4ba782d559ce10eb90d580N.exe
Size

57KB
MD5

a428de5d2f4ba782d559ce10eb90d580
SHA1

404e7b55a3a7431d017432b57d5e4914946b38d7
SHA256

72a2ea0833f2e01decf4b31882d25a9003582929b670577be777455f602c247e
SHA512

e7a75c2630772b958d96feb13245f445f1b9469fc916d4b743deced303895dc9e240d5e08f48e9e8cf705d8bb92fdbe35868f82b512e9cc0fbbbaa63c23cad28
SSDEEP

768:kBT37CPKKdJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQ7ZVnEbisFhiXFhKBg:CTW7JJZENTNyavf73tQqKBBBYCQC4

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4670) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002343b-2.dat	upx
behavioral2/files/0x000c0000000220a6-6.dat	upx
behavioral2/memory/3912-897-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxcompiler.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\LICENSE.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	a428de5d2f4ba782d559ce10eb90d580N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a428de5d2f4ba782d559ce10eb90d580N.exe

C:\Users\Admin\AppData\Local\Temp\a428de5d2f4ba782d559ce10eb90d580N.exe
"C:\Users\Admin\AppData\Local\Temp\a428de5d2f4ba782d559ce10eb90d580N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
58KB

MD5
2533e5c8d602ef76a938bd7954f4485d

SHA1
dfa7dc6b7275bfa6a99130e64a2ad3580f46b5d1

SHA256
4908a6fe0718f63c3727d24417af5bdf378ebabdf1a59c27549346ddab70be16

SHA512
1046b9d3396fe257392e9c06d429c5f67fe02d27d9c4aeb00ef25252c70e2bec3c923837f54d898985c710daa701dab86980070064111154c7924819eb58036b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
cf8b24b215b9e939660feb569c445e6c

SHA1
5464d5bbf839299177a3d4fde57ce335fce28a4f

SHA256
a6f93e47df17814c385ab0e31e534813db1100fff05b3d247b4c1f7f4bbda8e3

SHA512
ad8eb0e744a35e29e00f1a352c88c7f941dd2bf940de044c4b7c827c7cc8cbfdcfeaf4d8de33d98e6d5886cd0a0b24b671ebc09f90baef4b51344ee694c8c8e8

Download Submit
memory/3912-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3912-897-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download