059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbac

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
Size

24KB
MD5

d03c22fdfd96f6d8938435fda8741c20
SHA1

604389f321a20282ec6396ac100bc4bca3dd0db9
SHA256

059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbac
SHA512

ff6fdf3b39154d37ead82e8800f849048a6be017eb8401791af8ff7147fb5c9728f17f8c9e5105e97675f9e7583daa96cec3b726433f2afd1996cf33a0065326
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9AiOix:CTW7JJ7TF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4682) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3624-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023436-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3624-1090-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Xaml.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe

C:\Users\Admin\AppData\Local\Temp\059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe
"C:\Users\Admin\AppData\Local\Temp\059ebd4f33dd987470c430d937dcf100b01cb15874b2a08683d3f6e0fb75fbacN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
24KB

MD5
7378a39a5b7caa01fb3176771c0726c3

SHA1
4aa1e502a4695d651a40ac84f04d21b0d96833f6

SHA256
c42c6d5cc4343266ca9da1d7af50b0bd07c7cf38478bc1c9192154f3f69d1211

SHA512
3e5f7dd5cd49ae4a5476f128a42614da308a85b0d5e4a680a7a957f9a5c9423e50d6a9617e57c657d988732206f5aed0d29b31dfa0825bd007451a95f4949164

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
123KB

MD5
b75a2860ff40ea93f7fb70be42add384

SHA1
3053a25c31bde8f04eb09208a2aff99ae2737def

SHA256
d35904db58a8470b0707ac6370e5fa0fcea0c5764ee2f27fdad28df96aadc16a

SHA512
6d6855158933f198947466a634dafc45c3b62eba5810b67ec27074fe773503f585b18622eaede063ef33b528ddc229cc4e5ae74c68bceb0a368e8dbc79c6b42b

Download Submit
memory/3624-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3624-1090-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download