ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
Size

59KB
MD5

28c402435c712dc6e82f573b9b8e5ab0
SHA1

45c974c1b94ad5612d146897de7eadad114ba5fb
SHA256

ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1
SHA512

27b5a1886227b14fee14d303bb05227cfc58fe2a61b2ecd876f1d3668046aad0d85b9cacd781b2296330262c6911c5b7d5b8eb77e60c2b5097be6ae576956844
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8IZT+JZkeZrAJZkeZrP:KQSo7Zn

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4648) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1616-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023342-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/1616-875-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\FormatRevoke.pub.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe

C:\Users\Admin\AppData\Local\Temp\ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe
"C:\Users\Admin\AppData\Local\Temp\ae2382e4542b6bf0d8f2cf538467447ab57ea8e7513fb353ba4ce6622a70b4a1N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
59KB

MD5
60e09fa4ca5e9e6dad332bf93e85d032

SHA1
ed00fb17ac99e0224b9e53ca5cfdb6fd4f8aa3a3

SHA256
8e9578f1360b924e3ad6717ebf5bba55948f87e2474e47f3747e5654e8a8e237

SHA512
40e6a1708ecd5bf2046c99ba9a75a0aaacc1a087d7054a6d9d0ff303b6457bdd741fde1235a62354f2d3b51224dc423e111860f79ff4dba3b47a4894bec40d04

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
158KB

MD5
4e36b25a24432b4902b995dcc0fe3e80

SHA1
c7d10865899facae881ec1f7152dec0405c18b09

SHA256
33e594b0e1fc52f2555065f6ef5044568fe7d0baffc445fc3fcc5f742d18987e

SHA512
0ed44b865d3626bc3fd4510bed173cc34a55edc2a30e4dc6dfa2fe9b2389762e17eb5f71300f527133cb096ab8877112af42c87dac23dc2e99d07df5149ca005

Download Submit
memory/1616-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1616-875-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download