e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
Size

185KB
MD5

1763d9ba13123161b1d70f464a0bf330
SHA1

0bf3931bd51f80db15d2be19801296e84d3d0e3d
SHA256

e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54
SHA512

5311d1bd255c97418310037c4684463d54042e4d9a95dc087608ac6ae0cd327e6bac77d559fa44e4cea0f85576112fb534991a6ba2fe63f66d9eb6b862727ba8
SSDEEP

3072:fny1tEuQ1RCCZHrIZG1SKJqIqrZBSJs1OE5euosTzQhd:KbEuQrCs71qIqrqJsMEHoD

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4268) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000234c6-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/4980-800-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClientSideProviders.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\DisconnectInstall.ram.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe

C:\Users\Admin\AppData\Local\Temp\e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe
"C:\Users\Admin\AppData\Local\Temp\e91f53082660da21129571ddbecd253f41facfe51709cb74b2b6b85d604caf54N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
185KB

MD5
a4b43defea026742821a541a90411d50

SHA1
298bb818c32d031707aeb0edf774fd8ceaae1617

SHA256
f57417c06713bc7d9da38a0f3be36be0c78ef0e495d90677f746ec92fb89de73

SHA512
0dae47a710112a7695e773a0e94d703fea530a273dfcda96aa8585c03ca101b8fd3809e8f475851adf190751d20e378a090b8c95081f2d211c840100b9c0ba0c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
284KB

MD5
4675e1886a81cbacdc6338aba5fe2a20

SHA1
fedeb24e0d797d1fa12210e0c0a8484b28535289

SHA256
4e419a8d5d81fa1d94498b9f044d3afb719683a45da703336aeea16281a51623

SHA512
eaa3890002cd130cef72acfc057caf4babefd60d7a30c85be6fb14addc140d2702243ebc19acb8577b86005f57ac44046069471f1b7f8d65809d901cd399a61e

Download Submit
memory/4980-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4980-800-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download