4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
Size

52KB
MD5

0e5167b8f4e92469fd83c6e30c6b4c37
SHA1

605f3771eddae8e59d0dcbe853386f68b59707c9
SHA256

4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a
SHA512

000800c3ec3e3d33b0514521b866e793755571721a101781ec2de6e968354fa07a190fb2e3bcc5c2c17a43e30fc60baf99917dec84dd524c9775a40878cb4c31
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJ1EXBwzEXBwdcMcI9p:V7Zf/FAxTWoJJ7Tz

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2840-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b37-2.dat	upx
behavioral2/files/0x000600000001e5c2-6.dat	upx
behavioral2/memory/2840-788-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationCore.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.boot.tree.dat.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.White.png.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe

C:\Users\Admin\AppData\Local\Temp\4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe
"C:\Users\Admin\AppData\Local\Temp\4e33ae49c622b74926f22455de745381f5bff13d9560308d7d53c5ef3b86c78a.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

Filesize
52KB

MD5
7a97cb6dfe1cb7fba64bd3c59386859c

SHA1
0e33fc8540dd23a799a0821af7aca838ef05d35d

SHA256
f9297bbd02edd815018a416e012e4ea8ab52bc23edb9522f3501604917000cd1

SHA512
a1eadf5a4cf887d17c41c527f457624d9bc3937a526d8cc07de3f3ea12985f6c822dd28edc292b006047ca71fda3469853a1d340b584b8c4777ccdf9e01f0779

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
acff06fe7df6d7b6e6d850d315a03564

SHA1
831d5f9694109ebb1912a702eade1d124f70f68e

SHA256
ab3b0f59393f5a5e4d7f3f4d6a861073f07356178e6e8b57e642dcf808f34a5b

SHA512
9552aedd61e64de93710618af820baa53e165602f92e343642e5c44c3a2db0e6c216a560453302c2beb5ba0751716d37d7658dfdc35756ff3eaef700e6cb538c

Download Submit
memory/2840-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2840-788-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download