35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48b

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
Size

69KB
MD5

f83abf8102e2fdd69aa0348d8e740e10
SHA1

ed0c8c531af4204327a3c1dc6b055b01154bc9de
SHA256

35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48b
SHA512

493fe7302fc224f79acd7168d5e1310bf914f13ea0689930939be4da6c047669b44cb8508211797fd8a1d6fea31379ecdbdf12953a9b0815d03c257151b183a6
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9MBT37CPKKdJJ1EXBwzEQ:V7Zf/FAxTWoJJ7TUTW7JJ7TB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023497-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2244-858-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ul-oob.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe

C:\Users\Admin\AppData\Local\Temp\35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe
"C:\Users\Admin\AppData\Local\Temp\35f7968a6803c2af40d8cee1e44d08f46ab5ad08b71e6a0a0363da2f8455c48bN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
70KB

MD5
c9ec031acabbf65010f13800586e975f

SHA1
31dfbee23343c9ed35a8e4cc2ff20a6887e69ff9

SHA256
020edf5410aa1a4257e121340e9813c32ab2735e9c7f4eab8f554e32304d9d64

SHA512
9e5ecb667869d9774c8d340651352389540f36497131a315805c4300f0c4a29322b0c14d56a1d58c5122cfb6f08022d46eb5963dab00e99a78e26e9444392e90

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
168KB

MD5
ccce4ca459f314366f6f42c8d9d201af

SHA1
1bd1b4487d3a97ca16f9a60eb94f0e4062941997

SHA256
796434afa11d3a8db98d21d4e588c4ea7c1f98ad93abe880d00d8a9f93b12f1b

SHA512
7c12369f2cb5ed95f6b0d0122245fa0671b8a3b0d0727e820fb8d16241a028ed79e3e15b9dc770c87c06bfd889ab156e7ad3383a6d247a331311513f010703ec

Download Submit
memory/2244-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2244-858-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download