1153df12688e5fb565b712c8bd95c3d978f9e05cb3704f05517632f39cf046c6

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecfa3bffac2002c0707cae9c1e7b5340N.exe
Size

21KB
MD5

ecfa3bffac2002c0707cae9c1e7b5340
SHA1

1a5d4661f5ad35b4a4e812cc1df46c36a6cd973d
SHA256

1153df12688e5fb565b712c8bd95c3d978f9e05cb3704f05517632f39cf046c6
SHA512

ce0afa0774e0776386df1c1918e37281c0a42bb48e80085f96749a35cd9c1e8ddd58fa671cd4c14d248f0988051aad46459677a1b7e44d284672aa4c2eaf2fef
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJblDZblDZy924Su0QK8u2l1QI6924Su0QK8u2l1QIElv:kBT37CPKKdJJBZBZyF/MF/orMalY+

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3468-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023463-2.dat	upx
behavioral2/files/0x000600000001e5db-6.dat	upx
behavioral2/memory/3468-1108-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\trdtv2r41.xsl.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	ecfa3bffac2002c0707cae9c1e7b5340N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecfa3bffac2002c0707cae9c1e7b5340N.exe

C:\Users\Admin\AppData\Local\Temp\ecfa3bffac2002c0707cae9c1e7b5340N.exe
"C:\Users\Admin\AppData\Local\Temp\ecfa3bffac2002c0707cae9c1e7b5340N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
21KB

MD5
34bf4dd65cd38918bdb7c868fbbdb0ff

SHA1
217012baa9af17f143ea8d028ec63988b4443d61

SHA256
f83f99d47ffc45226c96ed90a86466a74c4727c6d54be0ea2501bfca2728e3dc

SHA512
e281a886ec53a4e54c0a11a251635a63db9305218f455e9b77ab3a583283795df27db03bdaacc0a5017f7d19cea6d84cc8b8d73895a4e35a15ce3d40e43c2297

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
120KB

MD5
4e1c42a929d196929b5ea709d7f9c95d

SHA1
78a985b2fa59ed68f06e3e14e95305b4ce0d68a4

SHA256
57396464014739ada35420ddea93b06fc78486685882e935786186741b8723ae

SHA512
99efec18e16b13efb0ef6bed24614b5fbedd3628ccfd2559a30cf00634784cc72d28cc48850f0546682733502a149829ee8e6f587f18df770c4cde4bb9f0bae2

Download Submit
memory/3468-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3468-1108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download