03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106

Analysis

max time kernel
119s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
Size

29KB
MD5

60b2751e4ba719bb1895818aa65ca490
SHA1

edc132aba9d5cecc9d44ed64787721ce6689d750
SHA256

03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106
SHA512

7c59d9d12c5bca225cab7667eaa031f038a6ebfe09711fe7cc11206849e5d93e4ab9b580d81db791007bfd0af125342e63a45b07481d8af933f914ff3b80b205
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9enq0vg:kBT37CPKKdJJ1EXBwzEXBwdcMcI9enct

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2876-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000a000000023454-2.dat	upx
behavioral2/files/0x000400000002291b-6.dat	upx
behavioral2/memory/2876-859-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-GB.pak.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe

C:\Users\Admin\AppData\Local\Temp\03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe
"C:\Users\Admin\AppData\Local\Temp\03288aee6954899e975e665ef194712b864bc8d8fed42c5c1400bc7f8b250106N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
29KB

MD5
dfeae6b52061bbb9d2ee5bd1bd860e2f

SHA1
d6140860f3f0d99b2898bb522dac8da3c06cb947

SHA256
0581b1ee83aa26781e581a50028916d0f95eb4557805133b1cb3cec3300f7903

SHA512
8271ed57fff3b8a4beba10344b9a0a7bc6adb77682af6de8b4332b336efea3764a066267aa274309c93171a7569d1dd50b0e1c438e23d7abc660607eae7aa9ba

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
128KB

MD5
937dff3efc2464db27398873c4f17b5d

SHA1
be2fccfd693471e518f1b3b2da16ae5a1fe37bea

SHA256
5b02f346912b8fdb7487992708f71e48fd90d6719347db667eb964b46bdfe824

SHA512
2e0f126f2f9e28724029e9d4494e6829ab952ffdd37b5bf986b7ea8e0cb8a23ed74c87d5366565e9a905e2866c9df77905555d7084b65db5e053fb139d7131c1

Download Submit
memory/2876-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2876-859-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download