58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
Size

73KB
MD5

7b664f3510964001a6f3e826c2212c10
SHA1

92df9c49536b0befc0576862462df1bac6fb12b3
SHA256

58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73
SHA512

e7514701bff69e5bfc39464c064b03710923e220d73c1487f7e1b6992f725a9357cee7225b623574bfac08c3a62dee763aa52a7bec15711e051cb84b21149f97
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOLKc/xJtLJtTG5Drf:KQSohsUsUKF

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000a000000023c09-2.dat	upx
behavioral2/files/0x000600000001e5c2-6.dat	upx
behavioral2/memory/4868-783-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Watcher.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ul-oob.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe.tmp	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe

C:\Users\Admin\AppData\Local\Temp\58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe
"C:\Users\Admin\AppData\Local\Temp\58392fd9d2986f19f59986b65ba5dab1bd2bef89b2dea409241414b6805a1d73N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

Filesize
73KB

MD5
97754715970eb3061e9d360b6f3ff301

SHA1
c44e055e3d0a53217f327ef48a4cd26c7a059a8f

SHA256
c3c7121131b69018e8c733e4c2039b7609024ee23ea4228e37fe11545163302c

SHA512
77be1e53aa3bd9d38e9808485045f5c7513608c4ecf00cbd9959346f8e42973c4e44af4456a8fe1bc653e7b704f32576be577a6344abe4e8c972ae6276d159ab

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
172KB

MD5
b0c0f6e31b40a1572ba94f3fcb694701

SHA1
e37cc6c55a22bc836cb6bcca6bc5931813697e14

SHA256
d022cebb6de353c210e9f2602915d7e621f47aa0d63e8212ad65412ee135ca86

SHA512
7d1bbce0d932c2c7681699c3542738aa92bb9e295474302a178e4af3ef0fcd1438db0139e174769aa58faf21559c077993f7193de5ce61831d48b7e23d1aefb6

Download Submit
memory/4868-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4868-783-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download