ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
Size

59KB
MD5

5bd35b63bfc971bfb4757f5415f80da0
SHA1

534a900e9e74fd77ca9aa37df0e24a78063a37a5
SHA256

ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250
SHA512

b9f9ea5dd7fa0c251104ed4fffd922d96684bbc97092771c1359076a656bbe43d07d51eb88570abb0e379f6ab512348c7a76140d7e9e2a9596b2d3f00fb5d3bc
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcwBcCBcw/tio/tix:V7Zf/FAxTWoJJ7TTQoQx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4653) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000234b1-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/2220-864-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Primitives.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\MergeInstall.bin.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe

C:\Users\Admin\AppData\Local\Temp\ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe
"C:\Users\Admin\AppData\Local\Temp\ae3dfe34ef0bef12bcbe3c5071f5fe02c9382fdc9f524c3adf18f0eccb729250N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
59KB

MD5
9a4e1d6e3c09409a18b2f62773104ded

SHA1
89488469e6f7bdf3c4159e9225564db57c2588b3

SHA256
15bedcfe41b3d1c9e98e79e59babee2861f7f900c49aa13816456d3706994950

SHA512
e24014c9b0b52f2288b132113dcb0ef4b9d9fe11e6b89d44adb47da35ce6ef623380a0ed41f06d6ae49f306f4cf8c4d34352aa50edf791fa01616fe35a12de6f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
783b6779cd2642f401ff2793aed7c87e

SHA1
11f3fe6acf7af917bdae3dc7e18e8096fce9ec0c

SHA256
e0874e9e3aa61a1c947e7f008fb94987193445890d69a92e09168e2c29679b10

SHA512
4d5a07661fdf2c7e3228a73d0790e1104b715c5eac06133d3dadb123507bbe95b25d4db14172223acd6533d53ba32effc1a1eaaf85bc1f9fa200a9ca39c87173

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-864-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download