ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
Size

67KB
MD5

d868f8e23aaff4f1836530fdd0f74670
SHA1

a2215c028de6b1c1bcc5eb97f8e509af60f0054c
SHA256

ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1
SHA512

419d071103f2c0e7d4513c0a4379dfae430cfb7e0c22d522a6256b26590e8f65315605b2385566cab69f0cb47a10b9966f6520f434750ad727027c0e9021899a
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxY5eYeNzp/pi:KQSox5v

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4624) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4588-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023468-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/4588-860-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\GrantLock.avi.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsBase.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll.tmp	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe

C:\Users\Admin\AppData\Local\Temp\ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe
"C:\Users\Admin\AppData\Local\Temp\ada2114fc0ce60eea6fa5595922e1a64fe299de3a0b4e720e934c4549806c6f1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
67KB

MD5
75424158ed3320a0dd55a10d87a0ff48

SHA1
d70ba678943b0bc9bf4223053c735c4c52ebc4a5

SHA256
572a4e04ea0e70c71aeff0ac233efdc5147de00ed4382d0e1251148224a82aed

SHA512
73d611216503224242e3e27518096786205bbcaeacc5471b26111829b64b2eaa14827a6bc290a2bd431ca7954b9137a20fe01059c7827d3bf9536db46ce38024

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
f998ad99f8e15d7c6eeb62e15b68c669

SHA1
ad227d4569f9f699676706a843cf567423e5ee06

SHA256
ec91b90f3f10cd743805547c24af3889b6a80296f57f6427dc3c4900ddfa0475

SHA512
f280610d0add8a228a784057cbe80f42bf8cefa1b1e841debd3a97c479c0f11cc5db1a71f7d93644500cd95de0fd27b81b9a7bcbd43f5f1f547ce05e36f98e6b

Download Submit
memory/4588-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4588-860-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download