741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
Size

79KB
MD5

e50f90a1578afff4f4e5cbf87753a1f0
SHA1

fd8d0fc37292fb471771a5cace842cd148222d9e
SHA256

741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dc
SHA512

2d44b5b96b2759f03b5e352bb8a6479c9189ff42fd691db0d96d04fa4d4ed81f7b31bc6a4b947365b0691a9ee244827bd6079515ec624e3fe1152d64e195ce15
SSDEEP

1536:V7Zf/FAxTWoJJ7TCTW7JJ7T3dsGagj/NQdsGagj/Nb:fny1dS

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4858) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2296-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000233d1-2.dat	upx
behavioral2/files/0x0014000000022913-6.dat	upx
behavioral2/memory/2296-872-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL065.XML.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jdk-1.8\LICENSE.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe

C:\Users\Admin\AppData\Local\Temp\741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe
"C:\Users\Admin\AppData\Local\Temp\741792563ab0ab14e6639f6e4b7a39b1eb8ac5f243f25cdc0539cb46b4eb36dcN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
80KB

MD5
dc61a45ad2859c9df9c95a2e71cd71f1

SHA1
ebaee074bd31a1bc3505a73c3f509ee32aeed030

SHA256
c0222bbaac3d5b230caaea591d73d79d5b62fcb47516247f69add9b64a9d32aa

SHA512
b1810e01aed3b39205716bb441fdb2b0e8a5e425fbfa42bc8bd549f651e502de4247d7a375552d272259b1f11b1ee36e03b181efa699ffdd33f0db72a3e7c875

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
178KB

MD5
6b864efc97d094ad3588fd1927489ee0

SHA1
d0b17083e4df10bd62a77c1b4bde6d9b36cb87b0

SHA256
0fcbe8c696679c49a110a8e1dfda0d644aa6fcf71e4acca3311b47cb83dc14fc

SHA512
65a9f057559e22f473c842f9813ac25caab25cda6d828c58966c0ce7cabcc8ffce30df7ff7456d123ab263c29463bc6499ca740b9402c1d59f2b161fda0f0e50

Download Submit
memory/2296-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2296-872-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download