a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
Size

37KB
MD5

8854f508c0dac8ef9fd887d5c971af10
SHA1

fda2ed40a0f854235ae847a28b7a642d5f1b983b
SHA256

a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5
SHA512

24b29e35033ae8ba0bc6b7f7ca56a953372651a2be6025ad244bc4a49b5f402e521d86b69f5fffd3357f730a2b1dda0fd4c225c02eab0bbacdc6eb4edecbef46
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9HxZgigB:CTW7JJ7TixB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000234a5-2.dat	upx
behavioral2/files/0x0014000000022936-6.dat	upx
behavioral2/memory/2916-925-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\hxds.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.tmp	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe

C:\Users\Admin\AppData\Local\Temp\a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe
"C:\Users\Admin\AppData\Local\Temp\a078ba59b40e024cd13ec3ad36fe0ebd7d283ac6616a51683123ad89aaddeaa5N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
37KB

MD5
36d0851208bc5ae44163833cf045ad7c

SHA1
e1e57530273bc2d7fd8e3529b083ea7c6c9c82c3

SHA256
2240c0fbce329085abcab15dc0e69b11e1a68635ffb8c1da179c8d89dd85166b

SHA512
394afb920f622311ec53218d71201657726ecf6f84b07cdde36051dbfc71b040553509148f8115e665ff9b83250f93105e1e212275e115c82325543ee9001668

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
8b453e7591cbd90999d6a53997699e65

SHA1
7ed7293510017f47a702350bf9b0a0793477ef05

SHA256
c8dc20ea3578cbafc4db8c864a939cd8338c3ca919881639bfaad09a4cfaf365

SHA512
9f61c4b3c2c7eb5b4f91195a7d2754db7b4f1cb00c2205f7ff23d328396fd0776048a43bf6e6464250487e4c1803b6b3f457bab80539d3ff11bbe25aa5a3e8c9

Download Submit
memory/2916-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2916-925-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download