3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
Size

61KB
MD5

87337807eab6f759ef4441f2774c04e0
SHA1

b48daba0525d67c123f8f294bc9238a4f9998240
SHA256

3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381
SHA512

76f5dd8d294643aa9a393774f803d2b063aab11f5acd0effcbf8540c8e4064bfc30f9c091cdd1b85bb6ef950558080405bc80ed50826356d69816d929caf3fc3
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATNyHF/MF/6m0m+Q:V7Zf/FAxTWoJJZENTNyl2Sm0mKg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4644) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/208-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0008000000023415-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/208-916-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\es-419.pak.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe

C:\Users\Admin\AppData\Local\Temp\3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe
"C:\Users\Admin\AppData\Local\Temp\3f0adef3fb28c8a7f6d36c708545f05501c93b866279b8e52ff6afd886bd9381N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
62KB

MD5
ab486e5df9973cdd3e1241c750eeac71

SHA1
d6394924456b37fc9812410a3c2c80061e605197

SHA256
eb5aa783670044f3ee50d01a6d79eca26e9b4d7d7485f140d04b4304ad0a231a

SHA512
21d6cb292d74fa5ff9ee0ef1a7a2d007fae2da2954567971a036fb8c22b0cce0f88c27aea211c3c88ddd57f1df521a274e6a8aa74cc01fe69afa8e74b70bcb28

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
880590cf34cc8225a4ee08e1de0ce6b6

SHA1
cd3f1346778c49ba03228a3c65c6ab2e7aac1076

SHA256
6e13e7ff81732d79b2f86b8baf38d62a35093af8e5d8901f261dc866880fb3c2

SHA512
0160ed334124f69f02b14cf09704475032b34d90a3613adfa8e95d75af4aef252aca1cd3281670a480c89b70ce5d78d18b7521d9da5db4702056ca2967000f8b

Download Submit
memory/208-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/208-916-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download