5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
Size

509KB
MD5

6e29f3dbff84ffa89a915b1d25cc4a54
SHA1

e236add846cb598ab8f373c2fb94c582bb7e924f
SHA256

5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33
SHA512

ca8973d2b56a792f3ba915700c8bdec2dc724cba254fab4c9c2ba6888ee3d3a3a97d81da4ac77adc78aa365aa8b246aa5963ceca8421e76ea672d8fc3cc4da0f
SSDEEP

12288:rIZGNXkbvLbIZGNXkbvLis89iMGsSaOyi/DIZGNXkbvLQ:rIZaXkbv/IZaXkbvWs89iMGsSaOyQIZg

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2495) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2616-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b19-2.dat	upx
behavioral2/files/0x00040000000228fe-6.dat	upx
behavioral2/memory/2616-482-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lt.pak.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpnr.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe

C:\Users\Admin\AppData\Local\Temp\5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe
"C:\Users\Admin\AppData\Local\Temp\5d11ccd0d88a2f10ff05ec21de7fba2ac386f1935c4836473a40fec03f1f6e33.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
509KB

MD5
ad6efd3878ce53f928ba6e3f3ebe5f3b

SHA1
37e235bcd4c7696d863a090a05e386a6299e150d

SHA256
ac5e54c092258a858c790e177769e7d768ca4a1536c95ca5c74be9d24c364f06

SHA512
cc3d4607a2813e74223a903b7918e7f41450e3dedac0bacec7349e64b142962edfab2f5702264dfecdbd4c979794c489d965ed776759bae3b402e4202093c562

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
608KB

MD5
f17b6b61aa409e92e0aaff506b4116bb

SHA1
42faed10857b65cf7fb171010a5614c05db8ab77

SHA256
93503fde83b74c3269ac36e202081ca43de0b29387e33af3e9ca094461ca8d0a

SHA512
350567b42e88c7dd1b18a2ba5dcbac02ce2d356b42528f3af790a133c89d23ee9648803fc3abe27538d732f574d14d87e3bf4cbc9e85e1675bdb66e100a63cbd

Download Submit
memory/2616-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2616-482-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download