38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
Size

85KB
MD5

d773e792fb3804582f93283d694bb6a4
SHA1

944719faa280cfa2fcec7fc30e0f426d613bd077
SHA256

38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603
SHA512

ad1963b2536df6b57eab6a68208dd3fc3cea6d965531b01936401b5d82c87c5b6353b8ddf0647cae9a38624289502140456c73bc15381cd40ef2517fa3ff8955
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8+g9VyjVyDeUeR:fnyiQSoCeUeR

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3316-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000233c9-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/3316-850-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-2-0.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClientSideProviders.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ru.pak.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe

C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe
"C:\Users\Admin\AppData\Local\Temp\38b08e98ac3326001430ba6cda759d47f31166712b0d402e8fc38d76c6d15603.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
86KB

MD5
c92cd44912743c370402c2e5b0c5f04a

SHA1
c48ce3c7c0f2d040ba9e40f9b7b0bc40f37b5928

SHA256
450f22004171aac7e3791463bc00f9abb01e490ab0591eb5a943b07960032378

SHA512
f4e5aa232acbee07468ad1ba5afaebc12064801745f78926ca7cf524fd435f127c93cf91f719f9d9b27981d412892c41d50bc82194c988bb34fd0ab034aea0c5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
184KB

MD5
b205de3a93580f3f372b33d663980242

SHA1
d31a7a6a5212673787972d0d2d53747b15de53d4

SHA256
910cc8b7e76fd1c9e719dc61a1111c500798aa482b526f1b0d0043eea98b92f7

SHA512
f43f26cc597999ff3143b1b7351103caeece5fc3ead141361836272cadbba94b76df5c5608632e86445ac6bd8caef207de1e86548f7604da1af2e6ea8863d952

Download Submit
memory/3316-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3316-850-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download