1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
Size

46KB
MD5

6d900b2e5f69c20f03ab1d53bb8f5480
SHA1

bf565812e2e8ac6751e48357f180f1959e3dce20
SHA256

1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2
SHA512

b33d40dc9caeeaafc6e92ccaf28edff5aedeaf3cc657f100f90dde06efda056f5dfcaf675f2c61aefba4056dda5789d67f58e9c9ecc1409097bb052c46267db5
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9HSW:V7Zf/FAxTWoJJ7T1SW

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1424-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233e2-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/1424-870-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ro.pak.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsFormsIntegration.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.FileVersionInfo.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe

C:\Users\Admin\AppData\Local\Temp\1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe
"C:\Users\Admin\AppData\Local\Temp\1053e64efcfbc88d4117f4918c2f64a99297f7d89b22bbda242a862ea17ca6a2N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
47KB

MD5
c71f5e11de873a56dcf196f21ae9cad3

SHA1
2d397364f5cd237edb1cad3280fc932627330ed2

SHA256
ef7cd26a5557a4f86bfea3addd5d260c3d0d047ec8b66bc34d47f3cf43fbead5

SHA512
455b2a2473b6b0a130e30d8824f9d696d223c840fe3c9222abf8defed4491e9c53db0c53f4cc54e92778a443af05d14150d9f5d674d12c028dddeb93ffa18f9c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
2dbc24131a8caeecf3d96ee12c779990

SHA1
37b5024f803fabc4af5845b974dcd9cee10a02a8

SHA256
8bba5063c1df9e412bf01a0bdd4e4ce16ea9bd5180997ae40574731db11ce0f9

SHA512
a8808b9ccc6f4b5cf01825415c840f8eb457bafdd9ad5413db742994014a78f90f5788c3424c0c29a6549b7b1dbb8e30586393fbfaa3c6f733fc84f41bda7b2c

Download Submit
memory/1424-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1424-870-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download