7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
Size

39KB
MD5

a1895f575b4f43712f948f3ad30858f0
SHA1

1bd51368bb18698e33b910af4199dd21501d1023
SHA256

7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315
SHA512

12f13138203483fb4a99a232ae61a9d78b2ea45beb57b786e4008d26a91f77861173abc90bd78a1d7f10ec74f123fd3d66ae9981dc24a14836bbf483da5afa24
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HxUYyTRPTpXYyTRPTpm:CTW7JJ7TbyxFIyxFm

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4694) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3712-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233d9-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/3712-906-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AdeModule.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe

C:\Users\Admin\AppData\Local\Temp\7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe
"C:\Users\Admin\AppData\Local\Temp\7e87d16d2ada62ae440a380a9e59b27c08437bea03d8c2033956d8ccb0be8315N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
39KB

MD5
5ec282ab790e3d595d5d823a4fac7f5e

SHA1
fa91bbc8a72975c18e4a660a574128c2276dfe1d

SHA256
787959b453fd2985f9d4b0de0c35a62ddfabfe2fc534766fc9a787cb140f4484

SHA512
74ba98a8c08addac46f57f347fb36ac2aba1c36fd50c504f636ed35bd49f4c6c61ae54e2f16a3d429124269253f700e0d7c42e66e6ce21188e00b78c4d30b1e2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
dc15766135378ba7b14190e9adb98903

SHA1
7485a75e2e4176e768df168975d5270a6840203c

SHA256
2d7b5231b8d018a822aca97dc4df1b61edb49f5adf7c1df3c7ee9445951df543

SHA512
748357c8d0b38f254a37349e4ae8d49c52d79aceb26db295331272ddb5c12a187ef38cdd212e954e5b036db28b58440845aacc52c3d51955c40625733f590a11

Download Submit
memory/3712-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3712-906-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download