7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
Size

360KB
MD5

c226c1bedb6312d12c18297a8175b90d
SHA1

9dbc5557ecf9d601d853746d49fe7468866f5e73
SHA256

7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e
SHA512

54135bace81be205168bb7db03550aafe15849da453f5dece406a2fc3f4bf7ce5be49f9b5da5684ea051e4b1643c2b05dc7136fa3d0be4d552264a046f390a10
SSDEEP

6144:KbEyyj2yAIJAEyyj2yAIJDyIjNDv0bNXkbvL19iMGsSaOyi3:WyAU8yAUDyIZGNXkbvL19iMGsSaOyi3

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2830) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4440-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b10-2.dat	upx
behavioral2/files/0x00040000000228fe-6.dat	upx
behavioral2/memory/4440-630-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Design.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\FindWatch.txt.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.AccessControl.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoCanary.png.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\coreclr.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe

C:\Users\Admin\AppData\Local\Temp\7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe
"C:\Users\Admin\AppData\Local\Temp\7a58f5e350735f2d7dc744ee1cbe66ed7ddf87ee06cb5bc0e563f39bdf56fd4e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini.tmp

Filesize
361KB

MD5
997502c459b61874f39674c0fcb4fbfc

SHA1
58f570524aef695cfa9c2f00b4d875c55b190ce7

SHA256
e47019721c4a7da7fd7ac180951dbce9f30a3c9ad65b1af9a82ff4fbc1eac2cf

SHA512
677c500ecc87d160850834e4d0f7de6b4440106e88549063a3df0b11e49164a8d2783b5491500368d8d93590e66fbbf285469fe05cd2e57df78ae1bd39d6d696

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
460KB

MD5
d7e9f1f7977eea298cfdf67cef8ac168

SHA1
ee9f68fcdf96e226df2000aba8ca09e0bbe0339e

SHA256
b777ed4c41988f275a6c14e8d840820a9e0c1bc60dd55d4109e440d8a14a5ff4

SHA512
11c6d3a104459d462384f0b2839574adcf7205e73b03331052b27288947bb89802ec7dac04f3fb43b75e63af49b72ccc42acc085a08e9dceeeacbe049cb434ec

Download Submit
memory/4440-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4440-630-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download