82ea3f69ef8df4bba45a9f7264dee6d651e1432547c246c22dd9dcd487c51bf1

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aa4463a321cde7dea17f9efdf9dad50N.exe
Size

77KB
MD5

7aa4463a321cde7dea17f9efdf9dad50
SHA1

e035ee707c4b6dff6b90ffe890a3979c3ee72c6d
SHA256

82ea3f69ef8df4bba45a9f7264dee6d651e1432547c246c22dd9dcd487c51bf1
SHA512

53fc265fff7397f31ee4ec4ebd3c544e3d413e0620ed1ffe15881c3d91a2c114ed746a3d49cba05d01d92da1b3206f478c32a01252198c1a422be9663950a4f8
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNy2/mepYXwILQW:V7Zf/FAxTWoJJZENTNyavf73tQqKBBBF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3580-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023442-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/3580-906-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sl.pak.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	7aa4463a321cde7dea17f9efdf9dad50N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aa4463a321cde7dea17f9efdf9dad50N.exe

C:\Users\Admin\AppData\Local\Temp\7aa4463a321cde7dea17f9efdf9dad50N.exe
"C:\Users\Admin\AppData\Local\Temp\7aa4463a321cde7dea17f9efdf9dad50N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
77KB

MD5
fff6e882e9d19dbc3a9b5e6707ccc6c7

SHA1
629ab2ad97b76c326613e065a862582faa1f0a02

SHA256
d4e2f391404b34c8b3a3d99c3ad63cafdb890f2c586836031f197d1c4672cad3

SHA512
093c3de9caa8e85bc5fffb2fa55ac3350689abb0fca5b4a885cd43039ff3aa06a5b56ac4e00b6126febae011b23f1104d795080d207d3fd8bbac17532c022e36

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
e5de90a9b7540573e7c7ae6cb6c6055e

SHA1
6926e6915b843ad4605c1e4b5f962e6dfa65bae3

SHA256
b3c8267a2f9fda0aad46a8603ab984703881cc29c676aabf9a17b040bfc658f7

SHA512
e21849ea95e86af8f0b29fbcf57261a8fc5ecc433b529a28717dd3106bd0f93c05f1c6a43e2db0229e19d9b990a6f255a4da1e6c2ac92b666661c7d233907fbb

Download Submit
memory/3580-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3580-906-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download