edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8

General

Target

edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
Size

80KB
MD5

59395313dd3d5e306907f5014f61f7bd
SHA1

86dab9ec8e0e8db7c48b12f612a63687770bc156
SHA256

edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8
SHA512

45deeb42f5fa8abfcd8989aa814a9fcffb7146a7c64e064ac29a2d5482f4e9d7a7f9a3fecaebbeecaaab4037b33eb2761afa6888ad9939fa20878875d124e613
SSDEEP

768:a7BlpyqaFAK65euBT37CPKKDm7UEXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2W:a7ZyqaFAxTW8iVRRNRR3EBbAjEkjEE

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4812) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5088-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/5088-660-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-phn.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe

C:\Users\Admin\AppData\Local\Temp\edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe
"C:\Users\Admin\AppData\Local\Temp\edb8018bf47fd8aa3bb8c7067dcf2f5e0ec2c585e6f3054b7218a8036278f5a8.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

Filesize
80KB

MD5
d57543c082a262940cdaeb212a961efd

SHA1
2e971d483d77b80b77d656986013a204065fd52b

SHA256
6ed6dee0016e5b77810d2c0ad440d2b59476f5b3ab5bb204760643ff7d927ebf

SHA512
912b2f5ddaa3a8d5be105684b015c5ca97ac41651c1e458914bfdf24c9b3fafaef1c3cebd643f3e9e85282d5159e3d2faf1f2d1ba44b813edc1f4448d7f1966d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
4018c47efef5676cc41b49296e772399

SHA1
e69a04621d3a95485fbc4f6957f83e1263f33122

SHA256
05feced82293b721d8aa377304087b596290edfbd1f0a4120c4f0e12015ddb28

SHA512
15041ed73310ae6c25673d25c6a5365e0f4c5aef939bf55a7fc01ae9d1f561fd3660fade770f82d7c0c2033e9124658f0b68ea0ae6f9370dac8864b1302b4478

Download Submit
memory/5088-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5088-660-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads