0fe04eb8a156701f4e9ec6024dca10ffb31751bed8c104748ab7a356aa313118

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c9a0daefc452ab3a2293bd686386e60N.exe
Size

67KB
MD5

2c9a0daefc452ab3a2293bd686386e60
SHA1

5afb718291f91bc0a338a57875d4914dd41c118c
SHA256

0fe04eb8a156701f4e9ec6024dca10ffb31751bed8c104748ab7a356aa313118
SHA512

e61c0e38599683b04bdd33d84826195e5b9ebf544877d90ee5d6fbdc5fdefa0405187087f11cbe35299e31a7cef4a623e75b5a8f8c1d45418da3c3513b8aeb2a
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxtdxcgMCYiplpK:KQSo4dxa7

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3183) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4784-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0008000000023421-2.dat	upx
behavioral2/files/0x0014000000022912-6.dat	upx
behavioral2/memory/4784-446-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\vulkan-1.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\LogoCanary.png.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	2c9a0daefc452ab3a2293bd686386e60N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2c9a0daefc452ab3a2293bd686386e60N.exe

C:\Users\Admin\AppData\Local\Temp\2c9a0daefc452ab3a2293bd686386e60N.exe
"C:\Users\Admin\AppData\Local\Temp\2c9a0daefc452ab3a2293bd686386e60N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
68KB

MD5
50d68197d6d504fa7792732ab178290a

SHA1
fcb740f4cf929de57291ac014daa6a99fa8713f6

SHA256
ac354bd05ea38bdefcd854c4efd9ffbe0ae35d8392aea6198b9a08030223907a

SHA512
3ffe362bed3eaf0b5ecd3843a7b9ba4c6cea692788e3f3f90932f2621db12de2ac425782226292a1c3e4672d1e80ed5cbb7fe43a7a536f588b4d6800a214c30b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
166KB

MD5
ed1d1e023502114d6db5f9a9f89533ed

SHA1
35219dd65b23bd42aeb2d3de93964d5cabc50a19

SHA256
4172c1d2f05bbe1d7cbad399da47374910fbba7e5cae646f3493bc188e75bfd9

SHA512
7d846005f35212af28b51fd2ac78a95d71198fb8e8548638a5e23cc5b7278bc037d0f687463601ff3af440b400803856a2340720fc50524781b075cd2ee75e5c

Download Submit
memory/4784-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4784-446-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download