f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4ccc

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
Size

58KB
MD5

fde751d4870de1b8ed8ef231d53746e0
SHA1

36d9e1c5171afe50d5818ec01157470ee72a9175
SHA256

f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4ccc
SHA512

579df03f73c85eafce3c11bfb9b312bcea5120fbcc1c31e1204200c9d8777482155560cd9304b39cca1cba39e622ad7889e8192b9f9252b2005edd7f11462ce6
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFIb:CTWn1++PJHJXA/OsIZfzc3/Q8IZTN

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4656) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3464-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023404-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/3464-927-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\msipc.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationProvider.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe

C:\Users\Admin\AppData\Local\Temp\f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe
"C:\Users\Admin\AppData\Local\Temp\f7295fe51db22db2f4b8ea8f575e0a5d258494fd275dfa15f6265a8fe35a4cccN.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
59KB

MD5
5a50d6f83036778e625eefe556b4b92b

SHA1
9cc48dcc20407f55f011012c803a22f03f21d1d0

SHA256
f6c8d7851bd5e5a48aeca9da2e6b6649a779f95187ce57450fed5844076f8813

SHA512
22a68be868fd6a1258481923787c12bb21b158e657af730ac7945da7e35db9cf03473e3c88992f752020dc1ed086aebc5bcbf0ff199f5c9fed98d4d5822496e4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
7f12b45fbcd16af1785af1e305f3e891

SHA1
f2832c1046ab0d4cd10c49003a103864e901b519

SHA256
a6fab4e6d5876d9c820ce8f27196514bf6a1cd9a4f8a31546422e59bdaed80d7

SHA512
8a524924b4df65d78f8b1cc19a3d6f5faf5c6402d2d57cad09d738e7af9fca2fb741045a74616679aef511fe03a2531cb8d524cf43d9d060cbc26302430a4c15

Download Submit
memory/3464-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3464-927-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download