334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
Size

50KB
MD5

57c3ff421157317024831131eacca995
SHA1

b37e462c66e4a9e8f6274c5c3ab66cba14ad8bb6
SHA256

334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618
SHA512

62c7629a4cfed5eed991f5ef807751aa74a58b1b2b3a50647bfc9a7eacb1abb9be026f69354aaa42c99fe2694d5d6601dbf55cb4a22baf8aac44ef364dd11766
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9eq:V7Zf/FAxTWoJJ7TUq

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5044) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00080000000235aa-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/2548-890-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Resources.pri.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe

C:\Users\Admin\AppData\Local\Temp\334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe
"C:\Users\Admin\AppData\Local\Temp\334c5507f3f639813d3e5bcb54a5952f8371df878116162623b89879c2381618.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4464,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:8
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
50KB

MD5
3333a43383b15ae877d446251d2d92f6

SHA1
456b9ca81ffcce731adc4aca3e91ffaed522605e

SHA256
de487744a0b82a5294b555a84554aadfdf154ad4c6930589dc501a542158b181

SHA512
8d23aebf2d4951034b5167f72db6f3074a32fab1de3702ceeb2b2a461218d99f1be86a9abc989c50092fdd76c4d476d57a0d834de9c1cd3ecd5bdd0a7d562cd1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
162KB

MD5
822e629cd8eb6dd9d0140470c3be3f29

SHA1
a6afdc2d46ba41c2d99d64ddcd9c64a661024fa9

SHA256
d4e80bea4fe7e1d66e9a2a857d0d41fbdab5573b98320cd1f920cb97395784dd

SHA512
8cdb55018501dac6e3a3a811701a110d846e8b066c046ea14b9934e5f5ddb66d61254461953de87f5ddb0f7163dd50035abed9a26b9078e92711e67329598754

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2548-890-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download