7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
Size

111KB
MD5

9ea8ff12641f26f994c2f2260a28a8ec
SHA1

18366dfa5672990d99ba24ca0e71198be0891f03
SHA256

7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1
SHA512

8fa23dab2c31733c8f5daa7a09b77cbaee91a05e0831826d116c68c1131d81eeda98838a54948e9556c8f07645965907714878f10afccddf495a35b443caaf9f
SSDEEP

1536:V7Zf/FAxTWoJJZENTBmRPsdj2hkAeCgI3i0CJS1Il+lM5QOVhFVh6Jb1Jb3rr:fny1tEyyj2yAeCgjJRDFDqrr

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b7e-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/2248-730-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Google\Chrome\Application\initial_preferences.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\dicjp.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe

C:\Users\Admin\AppData\Local\Temp\7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe
"C:\Users\Admin\AppData\Local\Temp\7196dbadd4fd7c5789df5087142cad50337e7ef63719e7c4c2f3be69670506e1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.tmp

Filesize
111KB

MD5
431a6cc9c7bb3b82fb5c51bbdb674254

SHA1
13766238f34dbff4129e074234a9ab7384e40f33

SHA256
81060f630b59396897aa8bedd0a1e7b91720fb2abe0339ab63b51bc5171ea581

SHA512
ad923c966c70d2c56cc1f2240851c881c3e922ec840da3250db8a0d7f35f9a73f2d9cf866c7c30fe1cd31e9957937cf5cd00ee0381d6b4710278d71310f19e53

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
210KB

MD5
5c0ffabffd5a2bc9dc248cfef2519a8c

SHA1
e04b7ba9452de515123f126f6fdc88cb34e56704

SHA256
c4a99e74908eeceb806c980c0bb098fe20989df480e967c1147aa63b29dcecc1

SHA512
efa6c7694a6699ca31d867dedeb00589009c8b01773a84ecbd5bd816cb25c899eb9519f459ef48526b2aab11eac13d6ac2f338582f5f4da6a4702bf140f2c94c

Download Submit
memory/2248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2248-730-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download