ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503d

Analysis

max time kernel
119s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
Size

55KB
MD5

72f0f3ab0480e2968955674c099bb420
SHA1

3c6ebd8d81fcd826c6a27fd582a1375a00e9413d
SHA256

ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503d
SHA512

18117d1a10e8b76442b27e078a4aea556980489b0ec9b691198a844260a926e8905e2906dfe054fa7d4dad57c5dd07357b108dae65be854b1840b66fe918db60
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9Dr5TG:V7Zf/FAxTWoJJ7TVr9G

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4621) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3396-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023616-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/3396-872-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\release.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.122.manifest.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe

C:\Users\Admin\AppData\Local\Temp\ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe
"C:\Users\Admin\AppData\Local\Temp\ef5d3ce7b07c492bc8b5208de9c72d4c48b8ea70599760177132dbfe4ad7503dN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4012,i,15336851255456239337,16379811035920490645,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
56KB

MD5
3c7f5e9e43f96125435ad477dc1a2a59

SHA1
2519ef65e12b7a81919fcac99b409872eb283974

SHA256
f1a6246668a06227c101343d8694b5bd375fc6e6983f89ff972f3dc5027c4fb1

SHA512
28f742950c474aa757f3b1edd9b40ef19a551c85d264e22917d3939dd21d9fce3046d93bcf362d992f287ea805e6eb5983a794fa2755494fdcb53686b1b745de

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
168KB

MD5
f3ecf00da5e53b7f9e3b456e9036d3d6

SHA1
ce5a9a28fbf8bff3d9ce4bca48c64151cc2f0210

SHA256
b328cde33d80602089779160afede0e36bcb55bd48b8f4238aef372ffd185df4

SHA512
752e20fd71fe54da0eaa9f44abcede266ce7cc2c4445b1273a712495ad0e4b6d39623a2cc3fdf605ce57681ec215b401856545935c5b1d8c716f178dfa3ec4bb

Download Submit
memory/3396-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3396-872-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download