43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
Size

281KB
MD5

b71ebb681af0ff0d0eca0d2b87785928
SHA1

84d4359b96869916cafb46f0455f67a2f097198e
SHA256

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1
SHA512

03ebfd885f81f5789b58b9485c144aff1598c0a25a9584c6de779401f90eefd39b730cfb01e006d506c871a0c8c63a9bab4cfee7f41270244c1dac0191581367
SSDEEP

6144:fEJIjNDv0bNXkbvLIEJIjNDv0bNXkbvLU:+IZGNXkbvLNIZGNXkbvLU

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2771) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000c000000023ba1-2.dat	upx
behavioral2/files/0x001400000002291d-6.dat	upx
behavioral2/memory/556-637-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Xaml.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_sw.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ca.pak.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_100_percent.pak.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\EnterWatch.txt.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe

C:\Users\Admin\AppData\Local\Temp\43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe
"C:\Users\Admin\AppData\Local\Temp\43ab8216568b650a8197b7da5f6f2ecc9306882f647e2c0fc5cf041d4579d8e1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini.tmp

Filesize
281KB

MD5
a7dffe890164a8b8bf38dbdf66420473

SHA1
fc7b11935df68185a0f91156c14600f5df8b1d8c

SHA256
cd968b698f800965a8fe60528c8fbc6709f5e19862d37e3f6d6a3542e41728bc

SHA512
f7a67fab4f76bd3f8b8bb0619a3a304942bacbe6678b70bd7e386aeb5bbe53019ddb017f613451484d7bd87af793a0f24347391f94ebc8f255bc18338882e981

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
380KB

MD5
27e0f692dfaacc9e4e96da9b5fefa475

SHA1
12167909f867220c61d3d0f9b06e7109e3325d99

SHA256
333acabc52124354e4caddd8d8e51684945b4b495d48d827ebf3f146da6f7c40

SHA512
a08d3b561e98a019c29a7fc449d74cb473e32334d509e884d35a6be585f2c92034e71401ae16813efd2951691982c4920dbd68f5d9d48cb15ae1d56ddfdb4298

Download Submit
memory/556-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/556-637-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download