ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
Size

62KB
MD5

2df1f8136098b8ca932651668f30337e
SHA1

f9882c84da091658f3826108e2be6cb027de2238
SHA256

ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d
SHA512

aee0b19ea2f58b05fd32c56cb2713e5ceba27928c129287add7ffad5bfbc923605f585e9a7bd6111432c8fcae61cf1571e922f692306fe20b56b8609498528d4
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Fa:V7Zf/FAxTWoJJ7THa

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023479-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/3452-1006-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMRAUT.DLL.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsFormsIntegration.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe

C:\Users\Admin\AppData\Local\Temp\ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe
"C:\Users\Admin\AppData\Local\Temp\ed34964815b8e46d95140afa6aab699ce39e7fc045d18b7db60b8641383fc48d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
62KB

MD5
da726a5025bac4c25144522d371c0c85

SHA1
3610423e6d5d48e122ecfad958c31f3a5b9ca776

SHA256
50dd5b3bc39cba4a8de75793aeb9f95a7d561823b94d044f212d4ebe464918bf

SHA512
836ae5fc9bf393f24ea9943815e0bff24438556eff8e8e84e45448013b5d85e487ceef11c3026321864c16255a5f7cdfc873b8d25944272a5b5cd5d26a9f59e2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
161KB

MD5
662d05e65347cde80ce57d85b582950e

SHA1
59db03d2cab41c3f3a5644d16179f1174bb339bb

SHA256
89ccd0d1fb321306884ebe512e63b0031c5f8fca04175ed42444b2a275e98d06

SHA512
324c27b580781dfe00dde8eaa2143162513b9259b3612ec09465d52b229200d703204fd163c108e22ed3002ab61d99c3fe9f2503325d71d1f023f4b44c3ead23

Download Submit
memory/3452-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3452-1006-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download