07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
Size

26KB
MD5

3b8f64203c4e7c0c2ef16712fb37be70
SHA1

54f6ab0756a22621dfbd14b3eab543a6a6a090a6
SHA256

07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6
SHA512

0a4d92afd89ae5e45cc373f69e33f491eb71283fea42625c1b587d8095bf80e11f5c00308a5ca52e4f50f78988dc9d54e5a805c9f3fd315b8562e3ee1a0ed37b
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9gpw:kBT37CPKKdJJ1EXBwzEXBwdcMcI9gpw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5244) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000b0000000233dc-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/4772-1033-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.Editors.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8EN.LEX.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe

C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe
"C:\Users\Admin\AppData\Local\Temp\07a301317b18347c15fae007799f85f173c19b4238787ac361c4056c521b0ec6N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
26KB

MD5
e94e61bd9b57eae21b6ca8c6d065f495

SHA1
9690d8612dcd365a7962581228404206f81e4e00

SHA256
3308bcc644e059fbbd0e3adc6c399a1451ad55d1bb09625e6f0cc639e2a63043

SHA512
42320c235e87027c0d050fc656391b9849b4ec54d11e02e82ea8c0826d4bb8a08074db3d89a4b348c31ec35b41d8b826158ae7c4ade017a20391d058572c8b45

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
125KB

MD5
bc5796cf55b1adb1fcb8053f05692955

SHA1
1c14f73abdbf5ffc7111a9b9a71fc355f797977a

SHA256
fcea44f5c0a2cd017a5afdd4e8fe1eb324d46b0e529e1fbd26234f71c77e4b94

SHA512
8ed9c60923a3b997f8d7e9db0afcd3d17f5565c994b509fc4f239730cd01612ba560d9391c7b288172c2dd02be57460ba3a27a5526e6ee843fff1567e3dfaa4f

Download Submit
memory/4772-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4772-1033-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download