29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
Size

165KB
MD5

de3e45ddc99ced0bf53edca442147648
SHA1

545426c5bfa80d4156c86217528612632686b3d9
SHA256

29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6
SHA512

cebbe25862e947ccf8f89cd69a9e0f36348ac36efb0aee8b59dcd360245dcf0368c024190fad7699c002963dac5289953e61ba3aab9219c934ac9182f9164262
SSDEEP

1536:V7Zf/FAxTWoJJZENTBHfiP3zHLe4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0bD:fny1tEULVWHIjN3tj6qnv0b2UrXkbvLu

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4289) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3380-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023c01-2.dat	upx
behavioral2/files/0x0008000000023c9a-6.dat	upx
behavioral2/memory/3380-666-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sw.pak.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe

C:\Users\Admin\AppData\Local\Temp\29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe
"C:\Users\Admin\AppData\Local\Temp\29e870507f65136b06f3609c86c396ffa7f0d1b4d5c9576140cf285c42bfdad6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.tmp

Filesize
166KB

MD5
7c09e451c485731b2f051821e81a02b1

SHA1
e97b9f267c7d7e220473e3a8bac61b77cc3af7b4

SHA256
bfe8b15372a60408c9807886bf15a80221d8f86e2c255510928b80a4c81ee552

SHA512
fdb2e792f6ba6707ff6f7608711e7003c146277385b86739b89b7ea181f650d3be067565f3de37446f12853a072e108d7cb807ab68705f878682aa3096d0e6a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
264KB

MD5
e805b396aaf02189606817efcf5bcd13

SHA1
ddc7c0ceefc2d0003f5a6c0e4f511ebcfa2d0a34

SHA256
9bab05d8ae0326f0a142e54a54ad9d6d4b411bdad8cac48a9e8f6000e856f324

SHA512
05fb7526e6230674182de71280c9c8745fe9839d76b51d312c5f4617dff079f14ede1168d14a4f31ceaf3e826e7f3c2d195ab18a14dd1d20ae37b2dadab4659a

Download Submit
memory/3380-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3380-666-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download