ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bd

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
Size

34KB
MD5

0272ac8f385b55e5c22f48fcd11543a0
SHA1

0208e3d1b0688342332be2677f610e5e9593f69c
SHA256

ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bd
SHA512

6bd506d1da607e4e6a41c79d4517e2ad3d73333b0878fb9267e0c74cae24218a26789df056898825c623f8bd3bb0bf040d4b01e60202d6493099ce54abf88891
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HF/MF/7Y+pi1xpY+pi1xN:CTW7JJ7Tj2TYllYlx

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4300-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000233d9-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/4300-932-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXT.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-BR.pak.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.Messages.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\7-Zip\Lang\ne.txt.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe

C:\Users\Admin\AppData\Local\Temp\ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe
"C:\Users\Admin\AppData\Local\Temp\ea738fdac0b20c4c3797966c0f3fe43ebee98af109d54844b61ed0771440f3bdN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
35KB

MD5
bb0b07d334984800384d535e3d8ff46d

SHA1
9e4c73ed14bd744e879ea57168d8dcd1bc465368

SHA256
b0493fe9da7ebb6eabbc3a159b3260b4106a0721a78bd36618fc753fbfd49e9e

SHA512
067cedd6ab84fddd122509ee9117372872fea4f46b7f828509ed3b7dca016c74198718fb06676eeb4364743cb9419ee689d2964cfa83f8cd9f9dd2b13591d745

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
92fe51699dd1f35b05842f413ed39466

SHA1
e73cefd66f95b00170f0db33ef94cfa1720276ef

SHA256
34ce87dc8bf336c7086466d3fd9d83c2108735607428cd987d3c45edce5e8da1

SHA512
6d591767d647b9e6d594377d8b2b123cf81c6f9c207119ab9cd6630d07ce310f14e4ea079e3217c5e7e30ca0423a84df94821a08d7791027c0a76a4458552df7

Download Submit
memory/4300-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4300-932-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download