94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
Size

87KB
MD5

390e4f5683bfe95c2971fbbb0a7a2e70
SHA1

4dd65561396e6b758d3bfb916394d8d6335406b3
SHA256

94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717
SHA512

1b8311b82fd93b012febf2f3ad360ed2042d2a57fb95e5a49725d0e18c210c4c63edb8a95a8fa9295d8e967cb0354e9a97df7909d46415bfbe9a4bf9169f0079
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxY5KwV:fnyiQSox5KwV

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4376) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4988-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000900000002361c-2.dat	upx
behavioral2/files/0x000600000001690a-6.dat	upx
behavioral2/memory/4988-848-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\v8_context_snapshot.bin.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationUI.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe

C:\Users\Admin\AppData\Local\Temp\94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe
"C:\Users\Admin\AppData\Local\Temp\94412aafebe2027f7ed127045f2590f83869e8fcc59e5fe338cb95d0ef8b4717N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1296,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
87KB

MD5
09c37fa5089ba7b6b05dd871530d33e6

SHA1
cfc7771232c4a4b05592e7bc48cc7635e68c65e9

SHA256
78086a1af1c164a787465f2877826bcd10f85861bbe7e1ab3f16417846f8828c

SHA512
b3a3246306e5e67468cfe6afff2a52d498ba75a0a9b26a2b45cb4e9e771688f2a44da66afd4986def0c5caae66eb5c2aa36b4b297ffe287780ea7987270b0467

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
199KB

MD5
b828c41aeaba49a5d205d06016b30894

SHA1
b51b443e4b0bdbd865e1c576bf00f60e045b3423

SHA256
489be24c911425209f59eaccea9493f260f16f2c9fc7b0b15043959997f264a3

SHA512
9b5e101a1496f0b073bb03e99ce81dd9dba79190731e167749f334230be8bd6ca4adf2431e03d951b190a444d3f73b0eed8320a50132e51b518cff05244867b4

Download Submit
memory/4988-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4988-848-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download