e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
Size

24KB
MD5

70d56fd1d4dc1921869af0faec886c20
SHA1

77913c2048aba8001d56ca586be4a47194c4df7d
SHA256

e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab
SHA512

004c65c2956206e7e9eae7f9db98f194a6e4b962832b60549b07269e683df103ac7424f6c0f8f0100a352a2a9b9c38af60d8ca7c8c97149ad5a08d889be22c89
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9qQn:kBT37CPKKdJJ1EXBwzEXBwdcMcI9p

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5281) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3140-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023486-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/3140-1015-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l1-2-0.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySharePoints.ico.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGCORE.DLL.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALN.TTF.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe

C:\Users\Admin\AppData\Local\Temp\e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe
"C:\Users\Admin\AppData\Local\Temp\e636d5e5fb6d62b7dce5bde6a6076ec000504e43ff9a577a58917efb13f389ab.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
25KB

MD5
b4ccfb5b04bcada8c037d406a10266c7

SHA1
3b0a935dffbe1b9290f5d688d2630cb8dcc5bfa2

SHA256
61817c4046b0ca3374524aebbb2d1912647cbe6db48a5f4d8ffb04a39ec27aaa

SHA512
062d95836376abd96d46c3a5f57f37ad5f7e3337e7b3e25df82c261ea572c3c77d26e8eb5d5ac2c7b8f1b15dc126bb692b250db2c06c62d236aff9b420a3d706

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
123KB

MD5
1f8c861b45dd316e77c72db3e0f13ec0

SHA1
007dac09192994caef0cd6d8e32658f2edb16d6c

SHA256
3b075570648096aaa08f205618c94df5f97d7f2d8332d5b4ac98fcfe15eebd10

SHA512
33347e8b62c6ae5b16641a013c79474876985eeb06b422a864bd50431ca490cd120a24e265058128585a95239947f3f747e2ec1ac504829768c465a7fa7735d5

Download Submit
memory/3140-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3140-1015-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download