08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 09:02 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
Size

208KB
MD5

51344a96e7badaa6d5380f6656298cb0
SHA1

26c413199d55cbc3f730918c9786543deed6cf4d
SHA256

08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82
SHA512

2dc8a130adf3931d7e0b54e8833255a73c305654147dd2bcc597be0f02bf44ced2caa926584153c6d12fa0b3125c454495444159369a9cf0320b3f8348424969
SSDEEP

3072:fny1Mwsny1MwnWHIjN3tj6qnv0b2UrXkbvLh:KRiIjNDv0bNXkbvLh

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3248-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000023ca3-2.dat	upx
behavioral2/files/0x0004000000022916-7.dat	upx
behavioral2/memory/3248-646-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe

C:\Users\Admin\AppData\Local\Temp\08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe
"C:\Users\Admin\AppData\Local\Temp\08574841cfeb8306a1b2ff5b275d326efb26f502cc47a7d95c18027b2904ee82.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3248

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

8.153.16.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.153.16.2.in-addr.arpa

IN PTR

Response

8.153.16.2.in-addr.arpa

IN PTR

a2-16-153-8deploystaticakamaitechnologiescom
DNS

133.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.32.126.40.in-addr.arpa

IN PTR

Response
DNS

167.173.78.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

167.173.78.104.in-addr.arpa

IN PTR

Response

167.173.78.104.in-addr.arpa

IN PTR

a104-78-173-167deploystaticakamaitechnologiescom
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

133.130.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.130.81.91.in-addr.arpa

IN PTR

Response
DNS

21.49.80.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.49.80.91.in-addr.arpa

IN PTR

Response
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

8.153.16.2.in-addr.arpa

dns

69 B
131 B
1
1

DNS Request

8.153.16.2.in-addr.arpa
8.8.8.8:53

133.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

133.32.126.40.in-addr.arpa
8.8.8.8:53

167.173.78.104.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

167.173.78.104.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

133.130.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

133.130.81.91.in-addr.arpa
8.8.8.8:53

21.49.80.91.in-addr.arpa

dns

70 B
145 B
1
1

DNS Request

21.49.80.91.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
209KB

MD5
f6626ae0c03dbe0ee1fd40c95e9dd017

SHA1
ac8c1b039ed5b760a2ef32b71765321e77699da9

SHA256
3c8116d58e96ce0a1f17393774b2cad6b565ed738a989c80b10bee1fe3b7cebb

SHA512
6a2e9edd0b18b1a48d1a0f47d1d018d0294f10bc278223fccf47fee1a62f2cd8c12ced7a02f7bbf257b29a0bfa4baabc16bcbe347a92238d2be31bf9fd45d03b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
307KB

MD5
ea42d06927509a14f7694adbf503e33a

SHA1
233957f0c28e32452b8aa4c7e90d6d97138c6d29

SHA256
7005fe2f5965077175481b587dcb2396edc114cf4cce516d9cf831ba4a502337

SHA512
55bd8c9d76f07d577a1ee53c65983010a634c9303cc30f495bc2cf07a2013905c6baea68b34a841de080f350377ae76730ce40e9637fac09106d8018f186490d

Download Submit
memory/3248-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3248-646-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.