03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
Size

76KB
MD5

cd5b72320dcc33d464af581b74685de0
SHA1

cd99abee768648faaeb7b896b80aa20dff8b0888
SHA256

03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4
SHA512

fb2920b11c365617b570470c7a52cd74e23dba205f29f071c2ea8166909b086eaedaabea37b6a1353709d8431d5ef1a1526c65b85945478885c7df707eb4e41b
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTG/osPosx:KQSohsUsUKn1P1x

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4372) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000500000001e64a-2.dat	upx
behavioral2/files/0x0004000000022922-6.dat	upx
behavioral2/memory/3004-819-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ReachFramework.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe

C:\Users\Admin\AppData\Local\Temp\03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe
"C:\Users\Admin\AppData\Local\Temp\03d90509345b979afb27d987e4da91fb950f89326c103f57d6178e02d563fcc4N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
76KB

MD5
3c45ddd8d3dc06ae04cd1916dd63d9a4

SHA1
b3fad7d9f037893968bb4247a899380f7c83f5d8

SHA256
dfb22a522383e700050ef68c97a55d2d4e1012d5549a9c14205bcec568c369af

SHA512
bd46a53bf5140799e23f744d6696aae24cb0d27d47c2b65b90f01160730d4b12876f8f5c65b9391d4a2549a3d932b2a23825d265fa923c342b3ac8ca64150d99

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
cb49b2d351a7fdd4910bbe28f7b8be60

SHA1
abbf02dd76d0f2d61a4a35e1ffb10faf7a10c33f

SHA256
be573e1a1d0275f476b9a728ce1d532466ba6019b109182b25dafc522cc08bb5

SHA512
2def376eeeb17c3c42a5fc5934e5837f797085f17d07af3eaeb61331737d1d7f767a2dc2acac3ed07ca03b649687fa82de7a46a55f427514e99a495f81a8d98d

Download Submit
memory/3004-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3004-819-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download