5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
Size

146KB
MD5

c463642173cfd448636657c21e40859b
SHA1

12e80bd51050a62847cb2857804fee992c470505
SHA256

5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da
SHA512

2447e603925bc32728b7b8381296d90b8a97046642900a6e80ffe756a989db14e6940fa17272294fa609959c062682c9bb81ca36e327c38cebc61600d19b4784
SSDEEP

3072:fny1tES0Sm3Ka9iMGfUSaOy9SnJUwFU+FUhFUeFUXFUqyqKRrpF6Pwb:KbEJSm3b9iMGsSaOyie

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2985) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b74-2.dat	upx
behavioral2/files/0x00040000000228fe-6.dat	upx
behavioral2/memory/2032-638-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_200_percent.pak.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.ZipFile.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrfralm.dat.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe

C:\Users\Admin\AppData\Local\Temp\5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe
"C:\Users\Admin\AppData\Local\Temp\5894f5a046be818145b2d107b71609a0fe6726e1ebabebc44d645d88caac90da.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
146KB

MD5
c488101617e797f40d8382d2153732df

SHA1
586693025e4d398e65da234d81c4494be831ea49

SHA256
8e8bcf5203976ce15d34f22cac78a4c54dad4c214e16e364ec4b686f1d6bae6d

SHA512
13d332f3d0659fdc733f400aef2d546f4071dde7dcbcdf333893adf5a321a2132bae612368e9e82bacbeaa018f3779ad124569e18d8582fd53ddb86800cfe533

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
245KB

MD5
78e01c3e9b7ddd4fa9da8e95325325eb

SHA1
1b90aa38992a1e06a78a75cf66ca4d6964dd50f1

SHA256
c26a501ba5b2a09bad2f83a525779968e19f24d7f3689de634ed7bb99ba5c357

SHA512
df99c5314dc4a595fb5aebca34ec9977fdc943d9cbdef61daf697330a965f087400568cd4bb67989cd984cecb6da2af66ab745bd5ee769af23dbf02a2290b501

Download Submit
memory/2032-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2032-638-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download