7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
Size

64KB
MD5

6729e3ebbb743ef510be4b2188ecaa80
SHA1

50e8b0b65b0e3f8f9e5f87f165bcf7c406fa71bf
SHA256

7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7
SHA512

3dd6d05a9c73b279089dfc5dc9087224e204b9b1157251d17b8454bff735d4db9a5334a22e3ea0fe92c1ad010b6898248cdd966e92ed7648fd5c0b5733f7ae24
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZT+JZkeZrAJZkeZrOos:KQSo7Zk

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002346f-2.dat	upx
behavioral2/files/0x0004000000022933-6.dat	upx
behavioral2/memory/3004-900-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\bundle.js.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe

C:\Users\Admin\AppData\Local\Temp\7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe
"C:\Users\Admin\AppData\Local\Temp\7a35302eb865e215486da9889196d4a67ed624b8731ee27023c64039ff5f4ec7N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
65KB

MD5
697f56397b4c28cd32b461edf9d99f0f

SHA1
5cac434c3797004254510fbf682326c3e3d2f94a

SHA256
f9f67195b90cb27041b3ee226473b97058cc7637855e7409d12a044e128eda9b

SHA512
5083d7d8bfc7256b430d83f36d20b25cdaf3f9dc7b580a0754bf4d530ccf1a62e29ba55be885577262c137d926a975d321c83cf5721bccd9851c04278c3b6321

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
d4cc9365ee886dda20099d3df2fbdd33

SHA1
e3ebb7c9d79256af85818ed509484d8b1e76370d

SHA256
71e31364b165603b0323c696a92ff0f6f3c4840acb6d74e169adbd7680fe51b8

SHA512
acbdd831d9df6c682cb39311e896a5231f7e18311ee1ca82c440a7d545ce71a8ed9859ad69acaa4c7f32acc193338ac85111fda8c015fcacd4dfea3740fa7d7a

Download Submit
memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3004-900-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download