cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97

General

Target

cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
Size

81KB
MD5

81c919b3614f0a58450bda439d2c7469
SHA1

eb93ff0369aa09022a7000ebb8b7c1245d79effe
SHA256

cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97
SHA512

571e16249a42c2183a471d9fd6ec3c196ff3fbc7807dbbd6f2e77c3819895c0edfb9c34efb3e7183756296bea935c26bd730d5e0dbbb49088a81027cb115c96b
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zx0Cq/8S/8dyw:fnyiQSop8i8dyw

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2780-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2780-44-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\CheckpointOut.M2V.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe

C:\Users\Admin\AppData\Local\Temp\cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe
"C:\Users\Admin\AppData\Local\Temp\cb478cd61d5252ada951e5f9a5ae9ea4a1a60f09e13ce80600cef47dccf43e97.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini.tmp

Filesize
81KB

MD5
62950baf58ba28b5c1e9697214dcb9a9

SHA1
be25af21026a0ae929bc4874e9b71d71a9d9e685

SHA256
2c79cbd1ad181932b02d89ba071dd4266c057de169256c2b5dd116be62f3a4d2

SHA512
d837e13f1583855a435b912a250d23ff087bac7ff524cb05ba207e18bd7aef336c9e8e9903bbd0a56d5cb1a6df08057946599814252a8acd258a0f5f934bd4cc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
90KB

MD5
1c74b373e981f9b5e23be7bdd25503ba

SHA1
b4f45231fe4a77266cb81cd754c4a66d454e3d10

SHA256
ee67a17f8a722fc2bcaf867c49ed6e3a527ae2dd1214a0e88e59be0cb5b6e772

SHA512
bf726e2112d4cf20ab35dcf9ed5997476c4525b41ac558b92a23619778a96f7d3c789c168eac363901a0c6281017ad941687a56368539e3758e3b57ffef22ec9

Download Submit
memory/2780-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2780-44-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads