be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
Size

48KB
MD5

6fa7c1e2c431c827d64e7a94ff33aef6
SHA1

10a4c4723c91e9913e7e0dbf7f3101969c3c5ad5
SHA256

be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518
SHA512

0df47a9a8b73281aaacaec43145af1d371ab6e8f3bcb96ce90760dc7750d3d5a2410c48bf08fb98b6861a2f7145e7721bc0bfaa0dbe161ec1081ff515c28d9cd
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8+g9VyjVyn:KQSok

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/540-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000800000002346d-2.dat	upx
behavioral2/files/0x00040000000228de-6.dat	upx
behavioral2/memory/540-1138-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\CheckpointRemove.M2TS.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\el.pak.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\DebugMove.rtf.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll.tmp	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe

C:\Users\Admin\AppData\Local\Temp\be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe
"C:\Users\Admin\AppData\Local\Temp\be10f2ebbc26aa8b55d0d527ca741040d31c67fcd7ce7039df812cb7f4568518.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
48KB

MD5
8b2cd9dfacac8a232a7b7d42525add23

SHA1
e7acd1775f5afdb11291078a48cabfdf351ded1e

SHA256
b9e014593343b6fb8585b17183be2431a2f5eed7c3230dd0eee43ee56815ac09

SHA512
2accb2787953336117bd948ca4687e201c155ff8757cf1eb512474a93b396a9f60c785a9ebbfdda352dc4fbf58c3eba8a91d68e3a053c8abe1b100873a9d6f06

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
147KB

MD5
eb8a3100216dd6ef2178467284ba6ab8

SHA1
763a893c348485f7043efa1c1872b319f4c063ee

SHA256
cd3f733017bf425695a3f93b767f86db0709269b87f010adb9412c90b0fbe8a7

SHA512
6759e7746f1234fc7e9db2ed1f95d2c819ce03baeefc5352ac23565f8d641af6b2ef9212f670532a6c7879698bed8583608d4cb336ae45e6d647cd98befeac4e

Download Submit
memory/540-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/540-1138-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download