1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
Size

63KB
MD5

d147377b5758551eb1130a4b98d7a790
SHA1

8cb79a4927cdddb13bbc111b9943906a4574a21c
SHA256

1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402
SHA512

b03739824aeac64c1c1639d4034aec25b53f56ee43fe10ef44cba954c64ec05016d60f9a3d9ed0a7cb4becd665b94c3f2bd5328c9166f5f622c6ddb79b1de5a9
SSDEEP

1536:V7Zf/FAxTWoJJ7TzJv+o5oJxJ0PYXA5pYxbOpCpFgTJMTTLG:fny1t+o5oJxJ0PYXA5pY1OpCpFgTJMTm

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023473-2.dat	upx
behavioral2/files/0x000f000000022902-6.dat	upx
behavioral2/memory/2376-924-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyResume.dotx.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe

C:\Users\Admin\AppData\Local\Temp\1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe
"C:\Users\Admin\AppData\Local\Temp\1453296982978cd54f835cf9cdc98f128ab387dd3b914ab096176ba567868402N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
63KB

MD5
fe47c6c3ddda7b44b049970d310d5b74

SHA1
9e506f1d22a44ccfabd846dc506cc31f8ec03db7

SHA256
bbfa63247b1782bf241e87bcb0a028b0c4cf28c822b7f44618ac45466ec7c58a

SHA512
5a75aef8399516ed1ee199596b2328285d972c0055d3635eca1cc55063e0e9c01132b15712bb3091ce4f0d14f8f27ffb208b2ad0f701d496591fa7a552638d2b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
162KB

MD5
142072f4106c58615b7ee1ea8d582afc

SHA1
e3791234c4c4e43ff7a0953a29e716a6470fa0ec

SHA256
c3a4d8eaa995e812f9cd47099176f93af2a1c1ddac0516893542f4af60282255

SHA512
76df31b54f60dec77332f0e1255f70ccf1eb8bdd1240b9eedbc152998c6049074976e82d4aef6818b848e9513f9969e2dabddb468760d6d27d888a242ec10ab1

Download Submit
memory/2376-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2376-924-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download