345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5

Analysis

max time kernel
150s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
Size

42KB
MD5

7ebfc337e1189d096c6640c744dfedc4
SHA1

68699c53f6df6e16c28b4206045a910bf5a113f7
SHA256

345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5
SHA512

e349ff0fc18cf48ff3889f3f214b0045a71fca1c969b5714d9f8c8a6016633481dd825b9efe4d27b5eec575ffa3e55df22fa08cc2ee1fe44b6fbc280482ca54c
SSDEEP

768:kBT37CPKKdJJ1EXBwzEXBwdcMcI9Ro+QOViJfo+QOViJqWNzOZzOr:CTW7JJ7TPUnWwMr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5186) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4948-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000a000000023cad-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/4948-767-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\external_extensions.json.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png.tmp	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe

C:\Users\Admin\AppData\Local\Temp\345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe
"C:\Users\Admin\AppData\Local\Temp\345c7f69431e499ac2c8480f4db1205062f707cb311cf50411b6a71c47487bc5.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

Filesize
42KB

MD5
4e3eff62c39d3e4475c8903810ddcdff

SHA1
ea1d7cf394efc37ef421936ddf110de84c74dfd1

SHA256
70687782550b17e1762dab95d6c59b6f2ab748dc87aaa0789057d1d7d4382c01

SHA512
e4a1b5857deb368c780c207a07b76eec9311dbfc429a93a42f0af2ec12318c257372b50ef87615872cae7b637977df9edb70dfda6bcaa902bc39c23fffbfd2e6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
141KB

MD5
ab7b4d22d702b59faf5a4774fb4f744e

SHA1
00e21d638d9f5a2678fe569d518679a04323fb7a

SHA256
f00be650c7b4f12c62d1a48c06767ae4d8c5b23a831dc3c6de6ca27369333511

SHA512
adbb4a7c63d24fc700cdb0c0a81018759817ac9389cf9a9c549f2720bd5fc4d45bc110df1a6f362610f88bdd8d033d601d0010d6cccb6f8276596bb3a148c40f

Download Submit
memory/4948-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4948-767-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download